The Impact of AI on the Future of Security Questionnaires

The Impact of AI
on the Future of
Security Questionnaires

What 300,000+ security questionnaire questions answered by Conveyor’s AI tell us about the future of security reviews

Every day, infosec and presales teams lament one thing...

Will we be completing questionnaires until the end of time?

Security questionnaires have likely been around since the 70s and 80s and in their more “modern” form, since the early 2000s

(the years of Myspace, iPods, and more...)

So naturally, with all the advances in LLMs today, everyone is wondering...

Is AI the key to stopping the questionnaire madness?

By analyzing the activity in Conveyor’s AI trust platform in 2023,
we try to predict the future of security questionnaires...

Security Document Downloads

0K+

Of F500 conducted reviews through Conveyor

Security Questions ANSWERED by CONVEYOR's AI

0k+

Predictions Summary

In the Report

See data insights + opinions from experts in infosec & presales

Prediction 1

No more question/answer knowledge bases to maintain

See Supporting Data

Prediction 2

Trust centers aren’t the final answer… just part of the answer

See Supporting Data

Prediction 3

Both parties rely on AI to finish the security review

See Supporting Data

Prediction 4

Companies continue to send custom, increasingly detailed questionnaires

See Supporting Data

Dig into each of these predictions

Prediction 1 🔮

No more question/answer knowledge bases to maintain.

Not only will AI use various source materials like a knowledge base, documents, and webpages to generate answers, it will also maintain that data for you.

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:
"On a scale of 1-5 (5 being very painful), how painful do you find maintaining your knowledge base?"

Hot Take #1

“I’m gonna say that’s a 4. It is VERY painful.”

Hot Take #2

“A 3. Even if software makes it easier, it’s still overall a horrible task.”

Hot Take #3

“I’ll say maybe a 3, but that’s just the nature of maintenance.”

What did 2023 tell us?

Based on the 300,000 questionnaire answers processed in Conveyor, here’s what we know...

Today, you need 500-1,000 question and answer pairs in your knowledge base for the highest precision and coverage by AI.

If you think your knowledge base is difficult to manage, you’re not alone.

Most companies struggle with maintaining an “effective” knowledge base.

Useless Questions

of a KB on avg is likely filled with “completely” useless questions (never used)

Mostly Useless Questions

of a KB on avg is filled with “mostly” useless questions (used 1-5x in a year)

Of the 100 questionnaire topic areas,
these were the top 10 most popular topics in 2023

Authentication - Password and MFA

Backups and Retention

Penetration Testing - including summaries

On-prem vs Cloud hosting

Encryption - In-transit, at-rest, and key management

Logical Data Separation

Disaster Recovery and Business Continuity

Change Management

Critical Third Party Vendors

SDLC

And the one question you’ll want to keep updated if your company has introduced AI in your software

"Does your model train on our data?"

Prediction 2 🔮

Trust centers aren’t the final answer… just part of the answer.
‍
There will always be a subset of customers who won’t self-serve and expect a “concierge” type service from your team for security reviews.

What did 2023 tell us?

Based on the 100k security document downloads in Conveyor, here’s what we know...

Even if you have perfect information in your trust center, many customers are likely still going to send a questionnaire.

of customers still sent a questionnaire even after accessing information in the trust center

Preventing questionnaires depend on the factors below, leverage of the customer (size of deal), maturity of their security organization, and willingness to self-serve.

Will a trust center deflect a questionnaire?

A trust center probably won’t deflect a security questionnaire if you’re selling into these industries

Conveyor answered the most questionnaires for companies in these industries in 2023.

IT Services

Financial Services

Banking

Retail

Hospitality & Health Care

Prediction 3 🔮

Both parties rely on AI to finish the security review… but only if AI is good enough.

As AI accuracy increases, presales teams will start to own the entire customer security review process.

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:
"What is the future of security questionnaires?"

Hot Take #1

“In my pipedream, it will be phased out because more and more companies are leaning toward automating and exposing as much information for self-serve as possible.

However, I suspect that with AI becoming more prevalent that companies will feel more empowered to send large questionnaires since they won't feel like they are wasting anyone's time. Maybe when it comes back, they'll have their AI review it and pull out red flags.

Ultimately, it will just be robots talking to each other.”

Hot Take #2

“It will be a simple prompt UI for customers - like extremely minimalist and delightful. One-click form completion.”

What did 2023 tell us?

Based on the 300,000 questionnaire answers processed in Conveyor, here’s what we know...

AI has proven itself to be pretty good as the “tireless, infosec analyst” this year with high rates of precision in question answering.

Conveyor's most successful customers were able to achieve on average:

92%

Questionnaire Answer Rate

Questions answered ÷ total number of questions

Questionnaire Precision

Questions answered correctly ÷ questions answered

AI was able to help teams significantly
reduce time spent on security questionnaires

reduction in time spent
on questionnaires

Teams want even higher precision from AI before letting a subset of customers self-serve answers using AI.

Survey results
If it was possible, would you want your smaller customers to self-serve answers to their questionnaires using AI, such that the only questionnaires you do by hand are for larger or high-value customers?

Hot Take #1

“No. Despite gains in AI accuracy, I do not see it reaching a point where we would rely on it completely.

We would not want an incorrect response being provided to any customer, large or small, given there could be commercial or regulatory implications to providing incorrect information.”

Hot Take #2

"Yes. In my role, nothing feels like a bigger waste of time than completing/reviewing a questionnaire for a small opportunity."

Prediction 4 🔮

Companies continue sending custom, increasingly detailed questionnaires, but AI helps teams by generating answers instantly

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:
"What is the future of security questionnaires?"

Hot Take #1

“Even more questionnaires with even more requests for details confirming the answers are implemented.”

Hot Take #2

“It still helps to have them because certifications can't cover all and they are out-of-date (agreed on, approved) by default ... so knowing specifics relating to the use case is needed.”

Hot Take #3

“Difficult to know. In some industries there may be a standardization on third party review organization to leverage a single review across multiple customers. That said, this hasn't gained traction yet [...] I think questionnaires will continue to exist for some time. They will grow in complexity and variability.”

What did 2023 tell us?

From the 300,000+ questions processed by Conveyor’s AI, here’s what we know...

Custom questionnaires dominate yet again and standardized questionnaires are becoming less common.

Types of questionnaires completed using
Conveyor's questionnaire software in 2023

The teams sending questionnaires favor excel over the other file types.

Questionnaire formats completed using Conveyor's
questionnaire software in 2023

You can also expect more portal-based questionnaires from these usual suspects.

Portal-based questionnaires completed using Conveyor's
questionnaire software in 2023

What about number of questions?

The average questionnaire is 80 questions give or take, but if you sell to industries like telecommunications or legal, you can expect significantly more.

Avg. Questionnaire Length

Questions

Telecom Industry

Above Average

Law Practice

Above Average

We think the ultimate future is...

Custom questions remain
and AI does the grunt work

Questions about your security posture likely won't go away anytime soon.
‍
Although we're not at full automation yet, here are some practical tips
to use when automating your customer security reviews today:

Analyze your "one source of truth"

AI for security reviews is converging towards just needing one source of truth to generate answers with.

Being able to identify what the most popular documents are and which are the top question and answer pairs to maintain will become increasingly important.

Get sales buy in for a trust center

Have a trust center or looking to implement one? Leveraging a trust portal makes documentation sharing automated and centralized for your team.

Pro tip: Make sure sales is bought in early. This makes adoption, push back on customers, and future deflection of questionnaires possible.

Delegate to presales/sales teams

Design processes so that Sales/Solutions Engineers can be the first line of defense when sharing info via a trust center, but also when taking a first pass of the questionnaire using AI.

Need somewhere to start? If you already have a security questionnaire automation software, try having sales upload questionnaires via Salesforce.

Thoroughly evaluate AI solutions

Evaluating an AI solution to automate answering security questionnaires?

Pro tip: Use these key metrics in your evaluation.

Time spent reviewing each answer
Time spent on each questionnaire getting answers back in original customer-ready format
Accuracy with precision and coverage rates including % of answers you don’t have to edit before you can send back to the customers

Ready to let AI do the hard work for you?

See how the most accurate AI on the market for security questionnaire automation can help you reduce time spent on questionnaires by 91%.

Try the AI in a free proof of concept.

Learn more about security questionnaire automation

Salespeak

Conversation with ConveyorAI

Hey there, We’d love to talk to you!

Under the EU Data protection regulation, we need your approval for the use of your personal information
(e.g your name and email address) you may provide as we communicate:

We may store your personal information and this chat so we can pick up the conversation when we talk later
We may send you emails to follow up on our discussion here
We may send you emails about our upcoming services and promotions

By accepting you consent to ourprivacy policy

Conversation Insights

Pain points identified

No pain points identified yet

Topics discussed

No topics discussed yet

Shared assets

No shared assets yet

What’s next

Curious how Conveyor could work for you? - ask me anything!

Inspiration questions

How does Conveyor speed up trust-building with customers?

Can AI really reduce questionnaire time by over 80 percent?

How can Conveyor eliminate tedious security questionnaires?

How does AI eliminate the need to maintain a knowledge base?

The Impact of AI on the Future of Security Questionnaires

Every day, infosec and presales teams lament one thing...Will we be completing questionnaires until the end of time?

In the Report

No more question/answer knowledge bases to maintain.Not only will AI use various source materials like a knowledge base, documents, and webpages to generate answers, it will also maintain that data for you.

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:"On a scale of 1-5 (5 being very painful), how painful do you find maintaining your knowledge base?"

What did 2023 tell us?

Today, you need 500-1,000 question and answer pairs in your knowledge base for the highest precision and coverage by AI.

If you think your knowledge base is difficult to manage, you’re not alone.

Of the 100 questionnaire topic areas, these were the top 10 most popular topics in 2023

And the one question you’ll want to keep updated if your company has introduced AI in your software

"Does your model train on our data?"

Trust centers aren’t the final answer… just part of the answer.‍There will always be a subset of customers who won’t self-serve and expect a “concierge” type service from your team for security reviews.

What did 2023 tell us?

Even if you have perfect information in your trust center, many customers are likely still going to send a questionnaire.

Preventing questionnaires depend on the factors below, leverage of the customer (size of deal), maturity of their security organization, and willingness to self-serve.

A trust center probably won’t deflect a security questionnaire if you’re selling into these industries

Both parties rely on AI to finish the security review… but only if AI is good enough.As AI accuracy increases, presales teams will start to own the entire customer security review process.

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:"What is the future of security questionnaires?"

What did 2023 tell us?

AI has proven itself to be pretty good as the “tireless, infosec analyst” this year with high rates of precision in question answering.

AI was able to help teams significantly reduce time spent on security questionnaires

Teams want even higher precision from AI before letting a subset of customers self-serve answers using AI.

Companies continue sending custom, increasingly detailed questionnaires, but AI helps teams by generating answers instantly

SURVEY RESULTS: HEAR FROM THE EXPERTS

We asked infosec and presales teams:"What is the future of security questionnaires?"

What did 2023 tell us?

Custom questionnaires dominate yet again and standardized questionnaires are becoming less common.

The teams sending questionnaires favor excel over the other file types.

You can also expect more portal-based questionnaires from these usual suspects.

What about number of questions?

Custom questions remain and AI does the grunt work

The Impact of AI
on the Future of
Security Questionnaires

Every day, infosec and presales teams lament one thing...

Will we be completing questionnaires until the end of time?

No more question/answer knowledge bases to maintain.

Not only will AI use various source materials like a knowledge base, documents, and webpages to generate answers, it will also maintain that data for you.

We asked infosec and presales teams:
"On a scale of 1-5 (5 being very painful), how painful do you find maintaining your knowledge base?"

Of the 100 questionnaire topic areas,
these were the top 10 most popular topics in 2023

Trust centers aren’t the final answer… just part of the answer.
‍
There will always be a subset of customers who won’t self-serve and expect a “concierge” type service from your team for security reviews.

Both parties rely on AI to finish the security review… but only if AI is good enough.

As AI accuracy increases, presales teams will start to own the entire customer security review process.

We asked infosec and presales teams:
"What is the future of security questionnaires?"

AI was able to help teams significantly
reduce time spent on security questionnaires

We asked infosec and presales teams:
"What is the future of security questionnaires?"

Custom questions remain
and AI does the grunt work