The Security Questions to Ask Every Vendor Before You Sign
Most vendor security questionnaires are theater. The vendor checks boxes, you feel covered, nothing gets verified. These are the questions that actually reveal something — and most standard questionnaires never ask them.
1:16
Transcript
You're trusting a vendor with your users' data. That's not a formality — it's a risk transfer. Most vendor security questionnaires are theater. The vendor checks boxes. You feel covered. Nothing gets verified. The questions that actually reveal something aren't on standard questionnaires. Let's fix that.
Five categories of questions that cut through the noise. Where does your data actually live? Do they have a SOC 2 Type II — not Type I, Type II. Have they had a breach, and how did they handle it? Who are their sub-processors — the vendors your vendor trusts with your data? And have they run a third-party pen test in the last twelve months?
Here's what separates a real answer from a deflection. A vendor who has done the work answers fast and specifically. A vendor who hasn't pivots to marketing. The pattern holds across every question. If they can't show you the SOC 2 report, that is the answer. If sub-processors are "confidential," walk away. Good vendors have nothing to hide and everything to prove.