Opinion: Security questionnaires are weak third-party risk evidence; defenders urged to demand verifiable proof from vendors
This SecurityWeek opinion piece by Sravish Sridhar (founder and CEO of TrustCloud) argues that self-reported security questionnaires are still the gate for B2B deals and vendor due diligence, even though practitioners know the answers are weak evidence. Companies fill out questionnaires as vendors and then trust the same kind of answers when assessing their own suppliers. The author cites rising third-party breach rates and costs, and the Target 2013 breach despite PCI DSS certification, to argue that attestations capture a point in time, not actual control state. He recommends shifting to evidence that the other party does not author. This is an industry commentary, not a report of a new incident.
Detalhes técnicos
- Verizon 2025 DBIR: the share of breaches involving a third party doubled from 15% to 30% in one year.
- IBM 2025 Cost of a Data Breach: third-party and supply-chain compromise was one of the costliest vectors at roughly $4.9 million per incident, while the overall average breach cost fell for the first time in five years.
- Target was PCI DSS compliant in September 2013 and disclosed a breach of 40 million payment cards that December.
- NYDFS October 2025 industry letter: vet vendors up front, reassess on a risk basis, obtain independent audit reports rather than relying on vendor statements, and recognize that compliance cannot be delegated to the vendor.
Remediação
- Assess vendors first with externally observable signals: exposed infrastructure, breach and incident history, and leaked or exposed credentials.
- Focus deep diligence on the few vendors holding significant data or access, and request reports, test results, or attestations signed by someone outside sales.
- When being assessed, be able to show current evidence for each contractual security clause, produce it on demand, and make sure it reflects what is actually running.
- Treat the questionnaire as a conversation starter, not the basis of the trust decision.
Linha do tempo
-
Opinion: Security questionnaires are weak third-party risk evidence; defenders urged to demand verifiable proof from vendors
ler a análise desta fonte ocultar
This SecurityWeek opinion piece by Sravish Sridhar (founder and CEO of TrustCloud) argues that self-reported security questionnaires are still the gate for B2B deals and vendor due diligence, even though practitioners know the answers are weak evidence. Companies fill out questionnaires as vendors and then trust the same kind of answers when assessing their own suppliers. The author cites rising third-party breach rates and costs, and the Target 2013 breach despite PCI DSS certification, to argue that attestations capture a point in time, not actual control state. He recommends shifting to evidence that the other party does not author. This is an industry commentary, not a report of a new incident.
Technical Details
- Verizon 2025 DBIR: the share of breaches involving a third party doubled from 15% to 30% in one year.
- IBM 2025 Cost of a Data Breach: third-party and supply-chain compromise was one of the costliest vectors at roughly $4.9 million per incident, while the overall average breach cost fell for the first time in five years.
- Target was PCI DSS compliant in September 2013 and disclosed a breach of 40 million payment cards that December.
- NYDFS October 2025 industry letter: vet vendors up front, reassess on a risk basis, obtain independent audit reports rather than relying on vendor statements, and recognize that compliance cannot be delegated to the vendor.
Remediation
- Assess vendors first with externally observable signals: exposed infrastructure, breach and incident history, and leaked or exposed credentials.
- Focus deep diligence on the few vendors holding significant data or access, and request reports, test results, or attestations signed by someone outside sales.
- When being assessed, be able to show current evidence for each contractual security clause, produce it on demand, and make sure it reflects what is actually running.
- Treat the questionnaire as a conversation starter, not the basis of the trust decision.