Security questionnaires still gate deals despite weak evidence
Original title: Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The author cites third-party breaches rising from 15% to 30% and urges proof such as audits instead of self-reports.
A SecurityWeek commentary argues that security questionnaires remain the record that gates vendor deals even though both buyers and sellers distrust the answers. It cites Verizon's 2025 DBIR, where the share of breaches involving a third party rose from 15% to 30%, and IBM's 2025 report putting third-party and supply-chain incidents at roughly $4.9 million. An October 2025 NYDFS industry letter tells supervised firms to vet vendors, reassess them over time, and obtain independent audits rather than rely on a vendor's own statements.
Unconfirmed: The cited breach statistics come from Verizon and IBM reports as used by the author, not new incident data.
- The author says some GRC staff answer two or three hundred questionnaires a year.
- NYDFS expects independent audit reports, not vendor self-attestation.
- Suggested checks include exposed systems, breach history, and leaked credentials.
- Target's 2013 PCI certification preceded disclosure of 40 million payment cards.
- Victims
- Target
- Organizations
- New York Department of Financial ServicesVerizonIBM
From the original article
5 min read at securityweek.com
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies. The post Nobody Trusts the Security Questionnaire.
By Sravish Sridhar · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.