Is Your Vendor Security Questionnaire Security Theater? What the Evidence Says

Almost every enterprise software deal now passes through a vendor security questionnaire. The vendor gets a spreadsheet, a few weeks and a deal on the line. The buyer gets hundreds of "Yes" answers.

A growing critique says the whole exercise measures how well a vendor writes answers, not how secure it is. We tested that claim against public evidence. It holds up better than the defenders would like, but "theater" goes too far.

The claim

The sharpest version comes from Brandefense, which argues that a questionnaire answer is "an assertion, not evidence" and that "questionnaire completion is activity. It is not security." UpGuard takes a softer line: questionnaires are accurate "only if they're utilized intelligently", but they are point-in-time snapshots that leave risk unknown between assessments.

Both companies sell what they propose instead. Brandefense sells continuous external monitoring and threat intelligence, and UpGuard sells security ratings. That doesn't make them wrong, but it's worth knowing who is making the case.

What the evidence shows

The format is large and self-reported. The industry-standard Standardized Information Gathering (SIG) questionnaire from Shared Assessments has 128 questions in its 2025 Lite version, 627 in Core and 1,936 in the full Detail version. Every answer is written by the vendor. Unless the buyer asks for proof, nothing is checked.

The risk it is meant to catch is growing. Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches had doubled to 30%.

Policy and configuration can diverge. In his prepared statement to Congress in May 2024, UnitedHealth Group CEO Andrew Witty said attackers entered Change Healthcare using "compromised credentials to remotely access a Change Healthcare Citrix portal" that "did not have multi-factor authentication." Roll Call reported that MFA was a company-wide requirement at UnitedHealth Group at the time.

There is no public record of what Change Healthcare's customers asked in their assessments, or how Change answered. The case still shows the weakness critics describe. "Do you enforce MFA on remote access?" can be answered truthfully at the level of policy while one system sits outside it.

Written security claims are hard to verify, even for regulators. The only part of the SEC's case against SolarWinds that survived a July 2024 ruling concerned the company's customer-facing "Security Statement", specifically its descriptions of access controls and password protocols. The SEC alleged those statements were misleading. The claim was never tested at trial: in November 2025 the parties agreed to dismiss the case with prejudice, and neither side admitted wrongdoing. The open question is how a buyer with one spreadsheet would test such claims when a regulator with subpoena power couldn't settle them.

Where the claim holds, and where it doesn't

It holds on three points. Answers are self-attested. They describe a moment, not a state. And they reward fluency: a well-staffed vendor with a polished answer library will look better on paper than a smaller one with stronger engineering. That last point is our interpretation, not a measured finding.

It breaks on two. First, questionnaires are often a regulatory expectation, not a choice. US banking regulators' 2023 Interagency Guidance on Third-Party Relationships expects due diligence on third parties, and the EU's DORA, in force since January 2025, puts third-party ICT risk squarely on financial entities. A structured questionnaire is the most common way to document that work.

Second, a written answer is a record. It gives buyers something to hold a vendor to and a fast way to spot obvious gaps. That's not theater. It's a filter that gets mistaken for a test.

What buyers should do differently

The fix is not to drop the questionnaire. It's to stop treating answers as the evidence.

• Tier before you send. A low-risk tool doesn't need 627 questions. Scope the questionnaire to the data and access the vendor will actually have.
• Pick the controls that matter and ask for artefacts. For the 10–15 controls tied to your risk (identity, logging, data handling, incident response), ask for evidence: configuration screenshots, a SOC 2 Type II report with its exceptions read, a bridge letter covering the gap since the audit period.
• Ask about exceptions, not policies. "Which systems are excluded from this control?" is more revealing than "Do you have this control?"
• Test it in the evaluation. Enforce SSO and MFA in a trial tenant, deprovision a user through SCIM, export the audit log. If a control matters, make it part of the bake-off.
• Reassess on change, not just on the calendar. A new integration, an acquisition or a major incident should trigger a fresh look.

What vendors should take from this

Vendors that hand over evidence early, through scoped audit reports, trust centres and test environments, give buyers what the questionnaire can't. As more buyers verify rather than read, a polished answer library will matter less than proof that holds up when someone checks.

Our view

This section is Picari's interpretation.

Vendor security questionnaires aren't theater, but they're not assurance either. A questionnaire is a vendor's pitch written as a spreadsheet: structured, useful for comparison and worth keeping on file. It is still a claim. The weight of a security review should move from what vendors say to what buyers can test, which is how we think every vendor decision should be made.

Sources

• Shared Assessments, "SIG 2025" (question counts), late 2024: sharedassessments.org
• Mitratech, "SIG 2025: Key Updates and Considerations", 16 Dec 2024: mitratech.com
• Verizon, "2025 Data Breach Investigations Report" press release, 23 Apr 2025: verizon.com
• TechTarget, "Change Healthcare breached via Citrix portal with no MFA", 30 Apr 2024: techtarget.com
• Roll Call, "Change Healthcare lacked safeguards even as it gave security advice", 7 May 2024: rollcall.com
• Winston & Strawn, "SEC and SolarWinds Litigation Dismissed Following Joint Stipulation", 16 Dec 2025: winston.com
• Morrison Foerster, "The SEC Backs Down in Landmark Cybersecurity Enforcement Case Against SolarWinds and Its CISO", 24 Nov 2025: mofo.com
• FDIC, Federal Reserve and OCC, "Interagency Guidance on Third-Party Relationships: Risk Management", June 2023: fdic.gov
• Brandefense, "Why Vendor Security Questionnaires Don't Work (And What Actually Does)", updated 22 Oct 2026: brandefense.io
• UpGuard, "Are Vendor Security Questionnaires Accurate?", 9 Jan 2025: upguard.com