Security Questionnaires Persist Despite Buyers’ Lack of Trust

SecurityWeek reports that the standard security questionnaire used in B2B deals is widely distrusted by those who fill it, yet remains central to let revenue flow. In the article by Sravish Sridhar, he describes how GRC analysts and compliance managers spend days answering hundreds of forms a year, often sacrificing personal time because a deal can hinge on the questionnaire.

He notes a double standard: vendors are asked to supply self‑reported assurances, which buyers then rely on when evaluating suppliers, despite the obvious lack of rigorous scrutiny during deadlines.

Sridhhar points to evidence that self‑reported answers are a weak basis for trust. He cites Verizon’s 2025 Data Breach Investigations Report showing third‑party involvement in breaches doubling from 15% to 30% in one year, and IBM’s 2025 Cost of a Data Breach reporting third‑party and supply‑chain compromises as among the most expensive vectors at about $4.9 million per incident.

He uses Target’s 2013 breach—despite PCI DSS certification—as a cautionary example: a certificate was real but beside the point, illustrating that a passing assessment does not guarantee security. The article further highlights regulatory moves, including a October 2025 NYDFS industry letter urging up‑front vendor vetting, ongoing reassessment, and independent audits, with a push to exchange verifiable evidence rather than self‑assertions.

The proposed remedy is to shift trust from self‑reported questionnaires to observable evidence: outside observations of infrastructure, incident history, and credentials leaks, plus evidence such as reports, test results, or attestations signed by independent parties. The piece argues buyers should demand real proof and vendors should show, not merely assert, compliance and security.