{ "study_id": "security-questionnaire-public-discussions-2026-10-15-v2", "version": 2, "title": "Customer security questionnaire public-discussion study", "analysed_on": "2026-10-15", "publication_window": { "from": "2024-10-15", "to": "2026-10-15" }, "population": "International convenience sample of public posts and comments, mainly software and security communities; no verified UK population", "unit": "Distinct discussion root for themes; posts, comments and platform accounts counted separately", "public_url": "https://theassurancedesk.com/data/research-security-questionnaires-2026-10-15.json", "screening": { "raw_records": 1409, "screening_units": 1381, "included_units": 123, "core_threads": 55, "screening_decisions": { "old": 15, "out_of_scope": 109, "promotion_or_product_research": 167, "published_context": 20, "included": 123, "opinion_or_no_direct_case": 225, "hold_untraceable_review": 2, "hold_commercial_context": 24, "out_of_scope_title_screen": 173, "practitioner_context": 37, "duplicate_source_item": 12, "unavailable_text": 16, "duplicate_case": 2, "hold_untraceable_item": 6, "out_of_scope_literal_screen": 444, "hold_unverified_date": 3, "outside_window": 3 }, "platforms": { "hackernews": 7, "reddit": 48 }, "source_item_counts": { "included_posts": 22, "included_comments": 102, "included_items": 124, "unique_public_accounts": 118, "items_without_account": 0 }, "sensitivity_without_reddit": 7, "sensitivity_without_flagged_units": 50 }, "themes": [ { "theme": "repeat_work", "label": "Repeating answers or formats", "threads": 15, "denominator": 55, "hn_threads": 2, "reddit_threads": 13, "without_flagged_units": 13 }, { "theme": "evidence", "label": "Finding or reusing evidence", "threads": 39, "denominator": 55, "hn_threads": 1, "reddit_threads": 38, "without_flagged_units": 37 }, { "theme": "missing_policy_control", "label": "A missing policy or control", "threads": 1, "denominator": 55, "hn_threads": 0, "reddit_threads": 1, "without_flagged_units": 1 }, { "theme": "ownership", "label": "Who handles or checks the work", "threads": 21, "denominator": 55, "hn_threads": 0, "reddit_threads": 21, "without_flagged_units": 19 }, { "theme": "certification", "label": "Certificates or audit reports", "threads": 26, "denominator": 55, "hn_threads": 3, "reddit_threads": 23, "without_flagged_units": 22 }, { "theme": "time_scale", "label": "Workload or questionnaire size", "threads": 23, "denominator": 55, "hn_threads": 3, "reddit_threads": 20, "without_flagged_units": 21 }, { "theme": "buyer_wait", "label": "Waiting after submission", "threads": 3, "denominator": 55, "hn_threads": 0, "reddit_threads": 3, "without_flagged_units": 2 }, { "theme": "question_fit", "label": "Outdated or poorly fitted questions", "threads": 11, "denominator": 55, "hn_threads": 4, "reddit_threads": 7, "without_flagged_units": 9 }, { "theme": "scope", "label": "Scope or level of assurance", "threads": 28, "denominator": 55, "hn_threads": 4, "reddit_threads": 24, "without_flagged_units": 25 }, { "theme": "accuracy", "label": "Checking or challenging answers", "threads": 20, "denominator": 55, "hn_threads": 0, "reddit_threads": 20, "without_flagged_units": 18 }, { "theme": "positive", "label": "Accepted approach or useful workaround", "threads": 30, "denominator": 55, "hn_threads": 3, "reddit_threads": 27, "without_flagged_units": 26 }, { "theme": "platform_fee", "label": "A platform fee requested", "threads": 1, "denominator": 55, "hn_threads": 0, "reddit_threads": 1, "without_flagged_units": 1 } ], "discussions": [ { "id": "D001", "root": "hn:41977205", "platform": "hackernews", "included_units": 2, "themes": [ "certification", "repeat_work", "time_scale", "scope" ], "sources": [ "https://news.ycombinator.com/item?id=41993197", "https://news.ycombinator.com/item?id=41990172" ], "summary": "A company working towards ISO 27001 said an identity platform alone did not answer its customer security questionnaires; its parent comment describes varied customer demands. A respondent describes varied customer requests and mapping its practices to custom questions.", "vendor_mention_sensitivity": false }, { "id": "D002", "root": "hn:42669754", "platform": "hackernews", "included_units": 1, "themes": [ "time_scale", "scope" ], "sources": [ "https://news.ycombinator.com/item?id=42673560" ], "summary": "Startup owner reports a long form before knowing whether the prospect is a real opportunity.", "vendor_mention_sensitivity": false }, { "id": "D003", "root": "hn:42725385", "platform": "hackernews", "included_units": 1, "themes": [ "repeat_work", "question_fit", "scope" ], "sources": [ "https://news.ycombinator.com/item?id=42727299" ], "summary": "A respondent described having to fill customer spreadsheets, including questions that referred to an inaccessible customer-internal classification.", "vendor_mention_sensitivity": false }, { "id": "D004", "root": "hn:43793526", "platform": "hackernews", "included_units": 1, "themes": [ "question_fit", "positive" ], "sources": [ "https://news.ycombinator.com/item?id=43799962" ], "summary": "Company gives a reason for declining forced password changes; reports no customer complaints.", "vendor_mention_sensitivity": false }, { "id": "D005", "root": "hn:43994486", "platform": "hackernews", "included_units": 1, "themes": [ "certification", "evidence" ], "sources": [ "https://news.ycombinator.com/item?id=44006613" ], "summary": "An in-house enterprise security worker described expecting audit and test evidence before sending a further security questionnaire.", "vendor_mention_sensitivity": false }, { "id": "D006", "root": "hn:44261777", "platform": "hackernews", "included_units": 2, "themes": [ "question_fit", "positive" ], "sources": [ "https://news.ycombinator.com/item?id=44277339", "https://news.ycombinator.com/item?id=44293279" ], "summary": "Customer questionnaires ask about password rotation; evidence-backed explanation reportedly accepted. Same author and discussion as P016; records explaining the deviation to customers.", "vendor_mention_sensitivity": false }, { "id": "D007", "root": "hn:48145524", "platform": "hackernews", "included_units": 5, "themes": [ "certification", "positive", "scope", "question_fit", "time_scale" ], "sources": [ "https://news.ycombinator.com/item?id=48146236", "https://news.ycombinator.com/item?id=48146259", "https://news.ycombinator.com/item?id=48151965", "https://news.ycombinator.com/item?id=48151962", "https://news.ycombinator.com/item?id=48150833" ], "summary": "Company used questionnaires instead of SOC 2 for some customers; exceptions became harder. Corporate assessor reports helping smaller suppliers complete forms or documenting accepted risk. A solo entrepreneur described questionnaires that did not fit a one-person business and said they stopped pursuing enterprise customers. A solo software founder reported selling without certification while remaining prepared to answer customer questionnaires; the claimed sales outcome was not independently checked. A small-company CTO says certification reduced its customer-assessment workload; the experience is unverified.", "vendor_mention_sensitivity": true }, { "id": "D008", "root": "reddit:1kobhc2", "platform": "reddit", "included_units": 1, "themes": [ "time_scale", "certification", "evidence", "scope" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1kobhc2/vendor_security_questionnaires_what_is_too_big/" ], "summary": "A recipient describes a large form and also says its own buyer reviews use audit reports where available.", "vendor_mention_sensitivity": false }, { "id": "D009", "root": "reddit:1n0hdck", "platform": "reddit", "included_units": 1, "themes": [ "time_scale", "evidence", "accuracy" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1n0hdck/how_do_you_automate_answering_security/" ], "summary": "A respondent receives several questionnaires each week and finds its answer library out of date.", "vendor_mention_sensitivity": false }, { "id": "D010", "root": "reddit:1o7hz24", "platform": "reddit", "included_units": 3, "themes": [ "positive", "time_scale", "ownership", "evidence" ], "sources": [ "https://www.reddit.com/r/AskNetsec/comments/1o7hz24/comment/nm7pg54/", "https://www.reddit.com/r/AskNetsec/comments/1o7hz24/comment/njyjgxj/", "https://www.reddit.com/r/AskNetsec/comments/1o7hz24/comment/njqrlks/" ], "summary": "A respondent reports automation reducing questionnaire effort without identifying a product or providing measured savings. A respondent gives a brief estimate of the share of a year spent on questionnaires; it is not a time log or an average. A team describes queue and specialist availability affecting turnaround and reports favourable customer feedback; calendar turnaround is not hands-on time.", "vendor_mention_sensitivity": false }, { "id": "D011", "root": "reddit:1o7ij8i", "platform": "reddit", "included_units": 1, "themes": [ "certification", "positive" ], "sources": [ "https://www.reddit.com/r/StartUpIndia/comments/1o7ij8i/comment/nkfj44x/" ], "summary": "A supplier reports its customers accepting an audit report while it still answers additional questions.", "vendor_mention_sensitivity": false }, { "id": "D012", "root": "reddit:1oe6m6e", "platform": "reddit", "included_units": 1, "themes": [ "scope" ], "sources": [ "https://www.reddit.com/r/sysadmin/comments/1oe6m6e/any_recommendations_for_security_assessments_for/" ], "summary": "A small company has completed a customer baseline form and is now trying to establish proportionate reviews of its own vendors.", "vendor_mention_sensitivity": true }, { "id": "D013", "root": "reddit:1ou23px", "platform": "reddit", "included_units": 4, "themes": [ "certification", "time_scale", "evidence", "ownership", "repeat_work", "question_fit", "accuracy", "scope", "positive" ], "sources": [ "https://www.reddit.com/r/grc/comments/1ou23px/the_pain_of_security_questionnaires/", "https://www.reddit.com/r/grc/comments/1ou23px/comment/nq0ey47/", "https://www.reddit.com/r/grc/comments/1ou23px/comment/nobwtb3/", "https://www.reddit.com/r/grc/comments/1ou23px/comment/nob04jc/" ], "summary": "A respondent reports completing a lengthy questionnaire as well as providing audit reports; its claimed hours are an anecdote. A small team reports a high annual questionnaire workload despite holding assurance evidence and using tools. A respondent describes buyers changing a standard questionnaire, requiring answers to be copied and checked again. A buyer describes accepting completed standard questionnaires while checking the scope of assurance evidence.", "vendor_mention_sensitivity": false }, { "id": "D014", "root": "reddit:1pav94w", "platform": "reddit", "included_units": 1, "themes": [ "certification", "time_scale", "ownership", "positive" ], "sources": [ "https://www.reddit.com/r/smallbusiness/comments/1pav94w/how_are_we_supposed_to_run_a_business_and_answer/" ], "summary": "A small company reports a customer accepting its unfinished SOC 2 work, while the lengthy questionnaire still takes staff time.", "vendor_mention_sensitivity": false }, { "id": "D015", "root": "reddit:1pkdnrr", "platform": "reddit", "included_units": 3, "themes": [ "evidence", "positive", "repeat_work", "accuracy", "ownership", "time_scale" ], "sources": [ "https://www.reddit.com/r/ITManagers/comments/1pkdnrr/comment/nuly2y4/", "https://www.reddit.com/r/ITManagers/comments/1pkdnrr/comment/nuiri5l/", "https://www.reddit.com/r/ITManagers/comments/1pkdnrr/comment/nuffyk6/" ], "summary": "A team both collects supplier answers and shares its own through a portal, reporting easier exchanges with other users of that system. A respondent reuses past forms, answers honestly and gathers input from several technical and business roles. A small business reuses previous answers and sends the form through technical and managing-director review.", "vendor_mention_sensitivity": false }, { "id": "D016", "root": "reddit:1po80se", "platform": "reddit", "included_units": 7, "themes": [ "repeat_work", "evidence", "ownership", "time_scale", "certification", "positive", "question_fit", "scope", "accuracy" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1po80se/enterprise_clients_keep_sending_security/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nuhs7ud/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nuh4j82/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nugfq2y/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nug9ox6/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nufj5th/", "https://www.reddit.com/r/SaaS/comments/1po80se/comment/nuef4yf/" ], "summary": "Small business-to-business team repeatedly rewrites overlapping answers without a compliance lead. A respondent reports customers accepting an audit report instead of a bespoke questionnaire. An employee recalls generic questionnaire questions that were irrelevant to the product being purchased. A team describes tagging and storing answers for reuse, then reviewing and tailoring drafts; claimed savings are unverified. A supplier reports that preparing a standard security packet improved its own onboarding process. A named supplier reports customers usually accepting pre-completed standard responses alongside its assurance report. A respondent reports using a paid platform to draft from policies and describes one completed questionnaire; it is not a timing benchmark.", "vendor_mention_sensitivity": true }, { "id": "D017", "root": "reddit:1ptyv9j", "platform": "reddit", "included_units": 3, "themes": [ "time_scale", "ownership", "scope", "positive", "evidence" ], "sources": [ "https://www.reddit.com/r/Sales_Professionals/comments/1ptyv9j/comment/nvlxx40/", "https://www.reddit.com/r/Sales_Professionals/comments/1ptyv9j/comment/nvlvdyk/", "https://www.reddit.com/r/Sales_Professionals/comments/1ptyv9j/comment/nvklngo/" ], "summary": "A respondent reports a long duration without separating calendar time from active work; the figure is not used as hands-on effort. A team declines most repeat customer questionnaires and sends exceptions to legal or security staff. A dedicated questionnaire owner describes taking over work from several teams and receiving widely varying formats and evidence demands.", "vendor_mention_sensitivity": false }, { "id": "D018", "root": "reddit:1puthra", "platform": "reddit", "included_units": 4, "themes": [ "repeat_work", "evidence", "ownership", "time_scale", "question_fit", "accuracy", "positive", "certification" ], "sources": [ "https://www.reddit.com/r/Information_Security/comments/1puthra/security_team_is_wasting_too_much_time_on/", "https://www.reddit.com/r/Information_Security/comments/1puthra/comment/nwdk5og/", "https://www.reddit.com/r/Information_Security/comments/1puthra/comment/nwa729k/", "https://www.reddit.com/r/Information_Security/comments/1puthra/comment/nw1nie4/" ], "summary": "A team rewrites overlapping answers and searches scattered evidence while sales presses for a quick response. A respondent receives questionnaires from existing clients and struggles to interpret some questions. A team reuses a completed standard questionnaire and assurance documents for AI drafting, then checks the result; it reports shorter response time. A company created a reference architecture mapped to its standards and reports that customers usually accepted it with few follow-up meetings.", "vendor_mention_sensitivity": false }, { "id": "D019", "root": "reddit:1q49z8u", "platform": "reddit", "included_units": 5, "themes": [ "repeat_work", "evidence", "ownership", "time_scale", "accuracy", "positive", "scope", "certification" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1q49z8u/anyone_else_drowning_in_security_questionnaires/", "https://www.reddit.com/r/cybersecurity/comments/1q49z8u/comment/o3whqq9/", "https://www.reddit.com/r/cybersecurity/comments/1q49z8u/comment/nxxair9/", "https://www.reddit.com/r/cybersecurity/comments/1q49z8u/comment/nxvktr9/", "https://www.reddit.com/r/cybersecurity/comments/1q49z8u/comment/nxtlyjh/" ], "summary": "IT team uses its own documents with an AI tool, then proofreads each response; reports time savings. A security department reports receiving many questionnaires and testing an internal drafting tool; the test completion rate is not treated as an operational result. A buyer describes a short standard form, separate AI/data review and acceptance of third-party assurance evidence. A former team supplied one standard questionnaire and audit reports, resisting custom forms, and reported that this worked for them. A team keeps a master answer document but still spends time adapting differently worded questions.", "vendor_mention_sensitivity": false }, { "id": "D020", "root": "reddit:1q77q58", "platform": "reddit", "included_units": 4, "themes": [ "repeat_work", "ownership", "certification", "time_scale", "question_fit", "scope", "positive", "evidence", "accuracy" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1q77q58/grc_is_a_scam_change_my_mind_aka_the_security/", "https://www.reddit.com/r/cybersecurity/comments/1q77q58/comment/nyqx8iy/", "https://www.reddit.com/r/cybersecurity/comments/1q77q58/comment/nyf7vcm/", "https://www.reddit.com/r/cybersecurity/comments/1q77q58/comment/nyek2j6/" ], "summary": "Company security lead reports long forms and AI questions; another commenter describes staffing for repeated formats. A worker with buyer and supplier experience says they shortened their own questionnaire. A reviewer describes using questionnaires to guide deeper interviews and checking other available documents. A reviewer describes following up questionnaire answers rather than relying on the completed form alone.", "vendor_mention_sensitivity": false }, { "id": "D021", "root": "reddit:1qjfvw1", "platform": "reddit", "included_units": 1, "themes": [ "ownership", "accuracy" ], "sources": [ "https://www.reddit.com/r/sysadmin/comments/1qjfvw1/why_do_some_csos_and_security_specialists_think/o1271wb/" ], "summary": "Security worker reports pushing back against an instruction to give false answers.", "vendor_mention_sensitivity": false }, { "id": "D022", "root": "reddit:1qpgwf1", "platform": "reddit", "included_units": 3, "themes": [ "repeat_work", "evidence", "buyer_wait", "accuracy", "ownership", "positive", "certification" ], "sources": [ "https://www.reddit.com/r/grc/comments/1qpgwf1/we_passed_security_questionnaires_but_nobody_told/", "https://www.reddit.com/r/grc/comments/1qpgwf1/comment/o2oruan/", "https://www.reddit.com/r/grc/comments/1qpgwf1/comment/o2d20ig/" ], "summary": "A supplier reports repeated requests for evidence in different formats after submitting its questionnaire, delaying the sale in its own account. A respondent describes moving from working alone to maintaining shared security material and walking buyers through a trust centre. A respondent reports fewer follow-up questions after obtaining a SOC 2 report, with some exceptions.", "vendor_mention_sensitivity": true }, { "id": "D023", "root": "reddit:1qvpiam", "platform": "reddit", "included_units": 1, "themes": [ "repeat_work", "accuracy" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1qvpiam/comment/o3j8kz9/" ], "summary": "A respondent describes repeated data-retention questions and expresses concern about checking nuanced AI answers; no actual AI failure is claimed.", "vendor_mention_sensitivity": false }, { "id": "D024", "root": "reddit:1r09l8a", "platform": "reddit", "included_units": 4, "themes": [ "question_fit", "evidence", "certification" ], "sources": [ "https://www.reddit.com/r/ciso/comments/1r09l8a/what_answers_does_a_ciso_you_expect_in_a_security/", "https://www.reddit.com/r/ciso/comments/1r09l8a/comment/o4m55be/", "https://www.reddit.com/r/ciso/comments/1r09l8a/comment/o4i1y00/", "https://www.reddit.com/r/ciso/comments/1r09l8a/comment/o4glzjn/" ], "summary": "A regular questionnaire respondent is unsure how much detail a broad risk-management question requires. A respondent describes a customer asking to inspect supporting evidence after reading its latest completed form. A reviewer describes reading assurance reports and asking questions about them. A buyer says they read questionnaire detail to assess protection of their company data.", "vendor_mention_sensitivity": false }, { "id": "D025", "root": "reddit:1r0xnti", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "positive" ], "sources": [ "https://www.reddit.com/r/smallbusiness/comments/1r0xnti/comment/o4mbh5s/" ], "summary": "A respondent describes implementing a shared answer document and automated retrieval, with advice to keep the answers current.", "vendor_mention_sensitivity": false }, { "id": "D026", "root": "reddit:1r10aw8", "platform": "reddit", "included_units": 2, "themes": [ "scope", "ownership", "evidence" ], "sources": [ "https://www.reddit.com/r/procurement/comments/1r10aw8/comment/o4xa6r4/", "https://www.reddit.com/r/procurement/comments/1r10aw8/comment/o4t8q4l/" ], "summary": "A buyer describes reviews sometimes occurring late and business or legal approval overriding concerns. A former bank buyer describes changing review depth to match data access and investigating higher-risk suppliers.", "vendor_mention_sensitivity": false }, { "id": "D027", "root": "reddit:1r42150", "platform": "reddit", "included_units": 1, "themes": [ "scope", "certification", "positive" ], "sources": [ "https://www.reddit.com/r/grc/comments/1r42150/comment/olw357g/" ], "summary": "A buyer reports using risk tiers and different checklists rather than sending every supplier the same long form.", "vendor_mention_sensitivity": false }, { "id": "D028", "root": "reddit:1rhnb76", "platform": "reddit", "included_units": 2, "themes": [ "evidence", "ownership", "positive", "repeat_work" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1rhnb76/comment/o80cerj/", "https://www.reddit.com/r/SaaS/comments/1rhnb76/comment/o801lb7/" ], "summary": "A supplier reports that preparing documents and involving buyer security teams earlier helped reviews progress. A team describes using tagged shared pages to retrieve its standard answers more easily.", "vendor_mention_sensitivity": false }, { "id": "D029", "root": "reddit:1rtf9lm", "platform": "reddit", "included_units": 5, "themes": [ "scope", "positive", "time_scale" ], "sources": [ "https://www.reddit.com/r/ciso/comments/1rtf9lm/comment/oaq4gi5/", "https://www.reddit.com/r/ciso/comments/1rtf9lm/comment/oajmz6h/", "https://www.reddit.com/r/ciso/comments/1rtf9lm/comment/oahsr5d/", "https://www.reddit.com/r/ciso/comments/1rtf9lm/comment/oafwjtn/", "https://www.reddit.com/r/ciso/comments/1rtf9lm/comment/oadnv1r/" ], "summary": "A person with buyer and supplier roles describes detailed requests early in procurement as a constraint; broader pricing assertions are not treated as measured evidence. A buyer reports useful responses to its short questionnaire; this is an individual judgement, not a tested optimum length. A buyer describes the length of its own questionnaire as sufficient for its needs. A respondent reports receiving long questionnaires; the range is a personal account rather than a benchmark. A team implementing supplier risk management wants to shorten its draft questionnaire.", "vendor_mention_sensitivity": false }, { "id": "D030", "root": "reddit:1ruzhsd", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "certification", "positive" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1ruzhsd/comment/oapqkqa/" ], "summary": "A supplier reports that sharing a security summary early reduced back-and-forth; no causal saving is measured.", "vendor_mention_sensitivity": false }, { "id": "D031", "root": "reddit:1ruzv99", "platform": "reddit", "included_units": 1, "themes": [ "buyer_wait" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1ruzv99/curious_what_actually_happens_when_vendors_submit/" ], "summary": "Sales engineer reports quick submission followed by weeks or months waiting on the customer.", "vendor_mention_sensitivity": false }, { "id": "D032", "root": "reddit:1s3tyrm", "platform": "reddit", "included_units": 4, "themes": [ "time_scale", "scope", "evidence" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1s3tyrm/how_long_do_security_questionnaires_usually_take/", "https://www.reddit.com/r/cybersecurity/comments/1s3tyrm/comment/ocih8ke/", "https://www.reddit.com/r/cybersecurity/comments/1s3tyrm/comment/ociatnq/", "https://www.reddit.com/r/cybersecurity/comments/1s3tyrm/comment/oci612p/" ], "summary": "A team reports receiving more security questionnaires and spending hours or days completing them; no typical duration is inferred. A supplier says questionnaire effort led it to turn down small engagements; no lost revenue is estimated. A respondent sets a multi-week return expectation; this is calendar turnaround, not hands-on hours. A respondent describes a lengthy evidence-heavy questionnaire taking more than a day, with another waiting.", "vendor_mention_sensitivity": false }, { "id": "D033", "root": "reddit:1srb3fa", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "time_scale" ], "sources": [ "https://www.reddit.com/r/InternalAudit/comments/1srb3fa/comment/ohdsipt/" ], "summary": "A former reviewer reports time spent mapping supplier reports to requirements; prospective AI benefits are not treated as results.", "vendor_mention_sensitivity": false }, { "id": "D034", "root": "reddit:1tan5b6", "platform": "reddit", "included_units": 3, "themes": [ "certification", "evidence", "accuracy", "scope" ], "sources": [ "https://www.reddit.com/r/Information_Security/comments/1tan5b6/comment/olgic5j/", "https://www.reddit.com/r/Information_Security/comments/1tan5b6/comment/olei8jz/", "https://www.reddit.com/r/Information_Security/comments/1tan5b6/comment/olbi2mm/" ], "summary": "A buyer describes checking a SOC 2 report and setting a follow-up review. A reviewer describes comparing questionnaire answers with policies and finding mismatches. A former team used short questionnaires for suppliers without SOC 2 reports.", "vendor_mention_sensitivity": false }, { "id": "D035", "root": "reddit:1td4gcn", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "question_fit" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1td4gcn/comment/olu4oyd/" ], "summary": "An employee describes complex wording in customer requests that ultimately asked for simple supporting evidence.", "vendor_mention_sensitivity": false }, { "id": "D036", "root": "reddit:1tve2tv", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "accuracy", "positive" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1tve2tv/comment/oq2v1yz/" ], "summary": "A software founder uses a reference of known facts with an AI assistant and checks the answers, preferring this to a separate questionnaire tool.", "vendor_mention_sensitivity": false }, { "id": "D037", "root": "reddit:1twk9mu", "platform": "reddit", "included_units": 1, "themes": [ "certification", "evidence", "scope" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1twk9mu/iso_27001_surveillance_audit_vs_full/" ], "summary": "A buyer questions what an ISO surveillance-year certificate tells it about a high-risk supplier.", "vendor_mention_sensitivity": false }, { "id": "D038", "root": "reddit:1u04ojy", "platform": "reddit", "included_units": 1, "themes": [ "certification", "evidence" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1u04ojy/vendor_iso_27001_assessment_questions_around/" ], "summary": "An in-house buyer asks a certified software vendor about testing and wants further evidence about the core product, rather than accepting the certificate alone.", "vendor_mention_sensitivity": false }, { "id": "D039", "root": "reddit:1u1rlmi", "platform": "reddit", "included_units": 6, "themes": [ "evidence", "ownership", "time_scale", "scope", "accuracy", "certification", "positive", "repeat_work" ], "sources": [ "https://www.reddit.com/r/grc/comments/1u1rlmi/how_to_deal_with_several_security_questionnaires/", "https://www.reddit.com/r/grc/comments/1u1rlmi/comment/or59c14/", "https://www.reddit.com/r/grc/comments/1u1rlmi/comment/oqu8huq/", "https://www.reddit.com/r/grc/comments/1u1rlmi/comment/oqtujrk/", "https://www.reddit.com/r/grc/comments/1u1rlmi/comment/oqsm36s/", "https://www.reddit.com/r/grc/comments/1u1rlmi/comment/oqs7a1l/" ], "summary": "Existing evidence library and AI assistance do not remove customer-portal entry or human review. A team reports a large workload spread across several staff despite efforts to reduce questionnaire requests. A buyer says some suppliers decline disproportionate requests, leading the buyer to accept their assurance reports and terms. A team both sends and answers questionnaires, prioritises larger deals, and says it still requires its own form; reported AI parsing failures inform its caution. A respondent drafts from past answers and documentation with AI, checks the result and reports less manual searching. A buyer describes accepting SOC 2 reports while requesting more from some smaller suppliers.", "vendor_mention_sensitivity": false }, { "id": "D040", "root": "reddit:1uccnif", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "scope", "positive" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1uccnif/founders_selling_to_enterprise_how_do_you_handle/" ], "summary": "Customer asks for AI-model, data-use and governance evidence; accepts a self-written PDF.", "vendor_mention_sensitivity": false }, { "id": "D041", "root": "reddit:1ukkvod", "platform": "reddit", "included_units": 3, "themes": [ "time_scale", "platform_fee", "evidence", "certification", "positive", "scope" ], "sources": [ "https://www.reddit.com/r/procurement/comments/1ukkvod/vendor_paying_for_security_assessment/", "https://www.reddit.com/r/procurement/comments/1ukkvod/comment/owb1c7z/", "https://www.reddit.com/r/procurement/comments/1ukkvod/comment/ouwo3kk/" ], "summary": "Supplier says a customer-required portal asks for an annual subscription before the form can be completed. A supplier describes a paid evidence-based assessment and says its score did not stop existing delivery; this is one unverified account. A procurement worker describes internal objections to a proposed supplier-paid portal requirement; self-described UK public-sector status is not independently verified.", "vendor_mention_sensitivity": false }, { "id": "D042", "root": "reddit:1uknqeo", "platform": "reddit", "included_units": 3, "themes": [ "repeat_work", "evidence", "time_scale", "ownership", "positive", "accuracy" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1uknqeo/comment/ovd8z1o/", "https://www.reddit.com/r/cybersecurity/comments/1uknqeo/comment/ov35uqo/", "https://www.reddit.com/r/cybersecurity/comments/1uknqeo/comment/ouxx12g/" ], "summary": "A respondent reuses an answer database but still spends time adapting each customer's format. A security team has transferred questionnaire handling to sales with AI assistance and occasional specialist questions. A respondent retrieves prior answers and reviews the output, while custom forms and formatting remain awkward.", "vendor_mention_sensitivity": false }, { "id": "D043", "root": "reddit:1uz0lry", "platform": "reddit", "included_units": 1, "themes": [ "time_scale", "scope" ], "sources": [ "https://reddit.com/r/SaaS/comments/1uz0lry/founders_what_does_privacysecurity_compliance/" ], "summary": "Small software company receives a 200-question customer form alongside other compliance demands.", "vendor_mention_sensitivity": false }, { "id": "D044", "root": "reddit:1v8tekg", "platform": "reddit", "included_units": 3, "themes": [ "ownership", "scope", "positive", "time_scale", "certification", "evidence" ], "sources": [ "https://www.reddit.com/r/sysadmin/comments/1v8tekg/comment/p0ch49q/", "https://www.reddit.com/r/sysadmin/comments/1v8tekg/comment/p0allld/", "https://www.reddit.com/r/sysadmin/comments/1v8tekg/comment/p090hy6/" ], "summary": "A worker says an acquiring company's specialist teams took over questionnaire work previously handled by the small business. A respondent describes long questionnaires but an established answer set alongside SOC 2 work. A commenter reports several full-time staff managing supplier compliance at their organisation.", "vendor_mention_sensitivity": false }, { "id": "D045", "root": "reddit:1vaof35", "platform": "reddit", "included_units": 1, "themes": [ "certification", "positive" ], "sources": [ "https://www.reddit.com/r/founder/comments/1vaof35/think_you_need_iso_27001_for_enterprise_customers/" ], "summary": "Founder says certification helped some deals but did not remove enterprise questionnaires.", "vendor_mention_sensitivity": true }, { "id": "D046", "root": "reddit:1vp9hid", "platform": "reddit", "included_units": 5, "themes": [ "certification", "evidence", "scope", "positive", "ownership" ], "sources": [ "https://www.reddit.com/r/Compliance/comments/1vp9hid/comment/p463t7o/", "https://www.reddit.com/r/Compliance/comments/1vp9hid/comment/p42tqh4/", "https://www.reddit.com/r/Compliance/comments/1vp9hid/comment/p3yp1ht/", "https://www.reddit.com/r/Compliance/comments/1vp9hid/comment/p3wpvz9/", "https://www.reddit.com/r/Compliance/comments/1vp9hid/comment/p3vt7nl/" ], "summary": "A buyer describes using certificates as a starting point and asking selected evidence questions. A European supplier reports customer acceptance of ISO 27001; this is not proof of equivalence or universal acceptance. A buyer describes rejecting some suppliers and allowing limited access with supporting controls in others. A buyer describes extra evidence review where standard assurance is unavailable, requiring business sponsorship. A buyer handling sensitive data says its organisation will not assess suppliers without a SOC report.", "vendor_mention_sensitivity": false }, { "id": "D047", "root": "reddit:1w464qe", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "accuracy", "positive" ], "sources": [ "https://www.reddit.com/r/Information_Security/comments/1w464qe/comment/p7gejpe/" ], "summary": "An employee describes an internal answer knowledge base with separate AI answering, updating and consistency checks; use is still early.", "vendor_mention_sensitivity": false }, { "id": "D048", "root": "reddit:1w644n6", "platform": "reddit", "included_units": 1, "themes": [ "missing_policy_control", "evidence", "accuracy" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1w644n6/comment/p7lx9kk/" ], "summary": "A respondent could describe offboarding practice but found no agreed written decision, making the answer feel like inventing policy.", "vendor_mention_sensitivity": false }, { "id": "D049", "root": "reddit:1wdn6at", "platform": "reddit", "included_units": 1, "themes": [ "evidence", "scope" ], "sources": [ "https://www.reddit.com/r/cybersecurity/comments/1wdn6at/comment/p9bu5yu/" ], "summary": "A buyer describes requesting configuration and retention evidence when reviewing data isolation, while doubting what a form can establish.", "vendor_mention_sensitivity": false }, { "id": "D050", "root": "reddit:1wytn0q", "platform": "reddit", "included_units": 2, "themes": [ "evidence", "certification", "scope", "accuracy", "positive", "question_fit" ], "sources": [ "https://www.reddit.com/r/AskNetsec/comments/1wytn0q/comment/pe8i8hy/", "https://www.reddit.com/r/AskNetsec/comments/1wytn0q/comment/pe5s0zg/" ], "summary": "An in-house reviewer starts with supplier documents and asks questions about remaining gaps, using an internal tool but reviewing the evidence; claimed time savings are not measured findings. A reviewer describes expanding questions when retention answers are vague or unfamiliar subprocessors appear.", "vendor_mention_sensitivity": false }, { "id": "D051", "root": "reddit:1x05eaw", "platform": "reddit", "included_units": 4, "themes": [ "scope", "certification", "ownership", "evidence", "accuracy" ], "sources": [ "https://www.reddit.com/r/grc/comments/1x05eaw/comment/peklupn/", "https://www.reddit.com/r/grc/comments/1x05eaw/comment/pei25sp/", "https://www.reddit.com/r/grc/comments/1x05eaw/comment/pehwn5a/", "https://www.reddit.com/r/grc/comments/1x05eaw/comment/pehqv58/" ], "summary": "A buyer describes custom questionnaires based on data access and tension between security review and business preferences. A buyer describes assembling several documents to understand data access, and finding that forms alone leave questions unanswered. A GRC worker describes repeated exchanges with the supplier and business owner before preparing a risk summary. A buyer describes chasing completed questionnaires and keeping evidence and findings across email, shared files and a task board.", "vendor_mention_sensitivity": false }, { "id": "D052", "root": "reddit:1x0ogfd", "platform": "reddit", "included_units": 2, "themes": [ "certification", "scope", "evidence", "positive" ], "sources": [ "https://www.reddit.com/r/grc/comments/1x0ogfd/my_bareminimum_vendor_risk_assessment_checklist/", "https://www.reddit.com/r/grc/comments/1x0ogfd/comment/pempsm3/" ], "summary": "A SaaS buyer is drafting risk tiers and a questionnaire/evidence checklist; no operating result is claimed. A buyer describes a scored short questionnaire plus follow-up questions and reports using it to triage further review.", "vendor_mention_sensitivity": false }, { "id": "D053", "root": "reddit:1x0okag", "platform": "reddit", "included_units": 1, "themes": [ "repeat_work", "evidence", "ownership", "accuracy" ], "sources": [ "https://www.reddit.com/r/soc2/comments/1x0okag/what_people_dont_see_behind_vendor_security/" ], "summary": "A respondent owns the spreadsheet, chases specialists and checks stale answers despite having an answer library.", "vendor_mention_sensitivity": false }, { "id": "D054", "root": "reddit:1x57br7", "platform": "reddit", "included_units": 2, "themes": [ "ownership", "scope", "evidence", "accuracy" ], "sources": [ "https://www.reddit.com/r/Information_Security/comments/1x57br7/third_party_risk_management_scope_keeps_expanding/", "https://www.reddit.com/r/Information_Security/comments/1x57br7/comment/pgknqqx/" ], "summary": "An in-house team describes cyber questionnaires as one part of expanding supplier-risk requirements without extra staffing. A former bank assessor contrasts verification visits with yes/no forms; historical recollections are not current prevalence estimates.", "vendor_mention_sensitivity": false }, { "id": "D055", "root": "reddit:1x5mil3", "platform": "reddit", "included_units": 1, "themes": [ "time_scale", "ownership", "repeat_work", "evidence", "buyer_wait" ], "sources": [ "https://www.reddit.com/r/SaaS/comments/1x5mil3/comment/pgnn4vp/" ], "summary": "A team describes its CTO handling questionnaires, reuse of a shared answer document and further buyer clarifications; reported stalled deals are unverified anecdotes.", "vendor_mention_sensitivity": false } ], "illustrative_discussion_ids": [ "D007", "D013", "D016", "D018", "D019", "D031", "D039", "D040", "D048", "D053" ], "sensitivity_exclude_units": [ "P095", "R099", "C154", "C325", "S031" ], "private_ledger_sha256": "cbaed4b638e4932201b994e960a4d0f8326e5783b5033f96a4647817633df8c5", "method": "The Assurance Desk expanded its frozen pilot on 15 October 2026 using stored client-scoped records, a focused Reddit collection, free Hacker News searches and selected public-web readings. Titles and literal topic matches were screened first, followed by reading relevant full posts and recovered comments. Only concrete first-hand accounts of responding to customer questionnaires or conducting in-house supplier reviews were included. Advice, promotion, unresolved commercial contexts, dates outside the window and untraceable items were excluded or held. Duplicate post/comment IDs were removed; repeated anecdotes across threads were also excluded where recognised. Qualifying replies could enter beneath an excluded opening post. Themes were coded per extract and counted once per discussion. The same AI analyst screened and re-read the included material. There was no independent human coding review. This is an exploratory study, not a representative survey.", "limits": [ "The sample is international and strongly weighted towards Reddit and software/security communities. Identities, employers, locations and truthfulness were not independently verified. Accounts are not verified people or companies.", "Searches were bounded and non-exhaustive. Reddit keyword discovery covered the past year; the intended publication window covers two years. Extra comments were requested under the busiest returned posts with a cap, favouring active threads. The complete contents of each discussion were not reviewed.", "The initial full-reading protocol was implemented with a title/literal pre-screen. Excluded titles and non-matching HN hits were not all read in full. Search records and screening units include repeat captures and are not respondents. A complete unique-item total for all excluded pilot captures is unavailable.", "Theme counts refer to explicit mentions in eligible extracts and overlap. Finding or reusing evidence includes successful approaches, not just problems. Counts do not rank the causes or severity of delays.", "Posted dates define the window; some accounts describe older experiences. Reddit dates were checked only to the available precision. Two free-web leads with an ambiguous rounded age were held outside the sample.", "The same analyst performed screening, coding and self-review. There is no independent agreement score or representative sampling. No UK prevalence, typical hours, average cost, lost-sales total or causal savings can be estimated.", "Accounts on different platforms are not joined. Repeat handles on one platform count once; multiple accounts could belong to the same person. Multiple comments are not independent survey responses.", "Removing Reddit leaves only the HN subset shown in the sensitivity table. Excluding discussions containing flagged commercial/vendor-mention units tests dependence on those discussions; it does not prove that other accounts are independent.", "Named-product experiences do not establish product performance. Known promotion and unresolved commercial contexts were held out. Platform-fee coding was introduced in the pilot and remains exploratory.", "One coded example of a missing written policy is not an estimate of security gaps in businesses. Practical workarounds and apparent successes are self-reports, not tested recommendations.", "The external UK government survey is separate. Its supplier-review percentages are not pooled with these discussion counts and do not measure questionnaire workload.", "Recorded public quotations may come from cached readings and may not show later edits. This study contains no interviews." ], "reuse_note": "Public file contains short reviewed summaries, codes, aggregate counts and source links. Raw captures, account handles and excluded-post judgements remain private.", "cohorts": { "frozen_pilot": 114, "reddit_keyword_posts": 268, "reddit_embedded_comments": 402, "hn_search": 542, "hn_parent_chain": 1, "additional_stored": 50, "free_web_opening_posts": 4 }, "sensitivity_definitions": { "without_reddit": "Remove all Reddit discussion roots.", "without_flagged_units": "Remove each whole discussion containing a flagged included unit, not just the flagged comment." } }