Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

What it is

An opinion piece in SecurityWeek arguing that the security questionnaire should start a conversation but not settle the trust decision. Its core observation is that each company fills out questionnaires for its customers and files vendors' answers as due diligence for its own purchases, so the same weak form is distrusted going out and trusted coming in.

What to do

The page gives separate steps for each side of the exchange.

When assessing a vendor:

• Before sending the questionnaire, check what is observable from outside: exposed infrastructure and the state of public-facing systems, breach and incident history, and leaked or exposed credentials.
• Spend the real effort on the few vendors that hold enough of your data or access to cause meaningful damage.
• Ask the rest for proof instead of prose: a report, a test result, or an attestation signed by someone who is not on the sales team.

When being assessed:

• Be able to answer "show me you are doing what this clause requires" with current evidence.
• Produce that evidence on demand, rather than retyping the same answers into each customer's form.
• Make sure written answers describe what is running now, not what was true when someone last typed them.
• Treat the security addendum, data processing agreement and AI addendum as the binding terms, since the questionnaire is not binding in the same way.

The October 2025 NYDFS industry letter, as the author describes it, expects regulated firms to:

• vet vendors up front;
• reassess them on a risk basis over time;
• obtain independent audit reports rather than rely on a vendor's own statements;
• recognize that compliance cannot be handed off to the vendor.

Caveats

The author concedes that outside-in observation is noisy, citing stale IP addresses and subdomains that were never the vendor's. The author's claim is that it is harder to dress up than a self-graded form, not that it is accurate on its own.

The page names no tools, products, scoring thresholds or evidence formats. It does not say how to decide which vendors count as high-risk, or how to verify an attestation. The Target example (PCI certified in September 2013, breach of 40 million cards disclosed that December) is used to show that a passing assessment reflects one day, not ongoing security.