NewsPublished 28 Oct 2026

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

Source SecurityWeek

Description

This article discusses the widespread reliance on security questionnaires in B2B transactions despite their inherent weaknesses. It highlights that these self-assessments are distrusted by those who fill them out but accepted by those who receive them, creating a paradox where trust is based on unverified vendor claims. The piece emphasizes that security questionnaires capture intentions rather than verified controls, contributing to persistent third-party breaches. It advocates for shifting from self-reported answers to observable evidence and independent attestations to establish trust between companies.

Impact

The reliance on self-reported security questionnaires as a primary basis for vendor trust contributes to an increase in third-party breaches, which have doubled in share according to Verizon's 2025 Data Breach Investigations Report. These breaches are costly, averaging approximately $4.9 million per incident, exceeding the global average. The practice of accepting self-assessments without independent verification undermines effective risk management and allows vulnerabilities in vendor security postures to persist undetected, increasing the likelihood and impact of supply chain compromises.

Defensive guidance

Organizations should reduce reliance on self-reported security questionnaires as the sole basis for vendor trust. Instead, they should incorporate observable external data such as exposed infrastructure status, breach and incident history, and leaked credentials. Focus efforts on high-risk vendors by requiring independent audit reports, penetration test results, or attestations from impartial parties. When being assessed, companies should be prepared to provide current, verifiable evidence demonstrating compliance with contractual security and data processing terms rather than relying on questionnaire responses. This approach aligns with regulatory expectations, such as those from the New York Department of Financial Services, which emphasize upfront vetting, risk-based reassessment, and independent verification.

Summary

The security questionnaire process, a gatekeeper in nearly every B2B deal, relies on self-assessments that are widely distrusted by the respondents yet accepted by recipients as proof of security posture. This creates a systemic double standard where companies distrust their own answers but rely on others' self-reports. Despite supplements like SOC 2 reports and penetration tests, the questionnaire remains central to due diligence, which is problematic because it reflects intentions or past states rather than current verified controls. The article cites industry data showing an increase in third-party breaches and their high costs, illustrating that compliance certifications do not guarantee security. It calls for a shift towards exchanging verifiable evidence—such as external observations, audit reports, and attestations—rather than relying on vendor assertions, aligning with regulatory guidance like that from NYDFS. This approach aims to improve trust and reduce risk in vendor relationships.

References

securityweek.com/nobody-trusts-the-security-questionnaire-we-rely-on-it-anyway/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Oct 2026, 10:42 UTC

Technical details

References

Community reviews