Vendor Security Questionnaire Workload & Automation Survey

Thank you for participating in this survey about vendor security questionnaire processes. Your responses will help us understand current workload patterns and identify where automation could have the greatest impact. Participation is entirely voluntary, and you may stop at any time. There are no right or wrong answers — we are interested in your honest experience. All responses will be kept confidential and reported only in aggregate. The survey takes approximately 8–10 minutes to complete.

Which best describes your involvement with vendor security questionnaires?

• We send questionnaires to vendors
• We respond to customer security questionnaires
• Both sending and responding
• Neither / Not applicable

Which internal functions do you collaborate with on vendor security questionnaires? (Select all that apply.)

• Security / GRC
• IT / Infrastructure
• Procurement / Sourcing
• Legal
• Privacy
• Finance
• Sales / Account teams
• Other internal partners
• None / Not applicable

Approximately how many vendor security questionnaires did you handle in the last 3 months?

• 0 (none)
• 1–5
• 6–15
• 16–30
• 31–50
• 51–100
• More than 100

On average, approximately how many questions does a typical vendor security questionnaire contain?

• Fewer than 25
• 25–50
• 51–100
• 101–200
• 201–500
• More than 500
• Not sure

On average, how many total person-hours are spent completing a single questionnaire across all contributors?

• Less than 1 hour
• 1–2 hours
• 3–5 hours
• 6–10 hours
• 11–20 hours
• 21–40 hours
• More than 40 hours
• Not sure

How would you rate the overall workload burden of vendor security questionnaires on you and your team?

How much does gathering evidence and supporting documentation contribute to your questionnaire workload?

How much does coordinating with internal subject-matter experts contribute to your questionnaire workload?

How much do redundant or overlapping questions across different questionnaires contribute to your workload?

How much does manual formatting, copy-pasting, or document assembly contribute to your questionnaire workload?

How much do ambiguous or poorly worded questions from requestors contribute to your questionnaire workload?

How much does tracking status and following up across stakeholders contribute to your questionnaire workload?

Which tools or approaches does your team currently use to streamline vendor security questionnaires? (Select all that apply.)

• VRM platform (third-party risk tool)
• AI-assisted answer suggestions
• Answer library / knowledge base
• Workflow or ticketing system
• Intake or request portal
• Macros, templates, or playbooks
• Other (please specify)
• None of the above

What are your biggest concerns about increasing automation of vendor security questionnaires? (Select all that apply.)

• Inaccuracy or hallucinations
• Data leakage or confidentiality risks
• Compliance or regulatory risk
• Explainability / traceability of answers
• Model or content maintenance burden
• User adoption and change management
• Cost vs. benefit
• Other (please specify)

Rank the following automation opportunities by priority for your team, with the top item being the highest priority.

1. Automated evidence and document collection
2. Auto-mapping and de-duplication of questions
3. Answer library with versioning and governance
4. Vendor portal with status tracking and collaboration
5. Risk scoring or control gap suggestions
6. Contract and security clause extraction and linkage

What is the minimum level of accuracy you would require from AI-generated draft answers before human review?

• Below 60% — any draft is better than starting from scratch
• 60–69% — a rough starting point is acceptable
• 70–79% — most content should be usable
• 80–89% — only minor edits needed
• 90–95% — nearly final quality expected
• Above 95% — only trivial corrections acceptable

Which performance metrics does your team currently track for vendor security questionnaires? (Select all that apply.)

• Cycle time (request to completion)
• Touch time (active work hours)
• Rework or clarification rate
• SLA adherence
• Vendor response quality
• Volume throughput
• Backlog / queue size
• Other (please specify)
• None / Not sure

What is your team's target turnaround time for completing a standard vendor security questionnaire?

• No target set
• 1–3 business days
• 4–5 business days
• 6–10 business days
• 11–15 business days
• 16–20 business days
• More than 20 business days

How willing are you to participate in piloting new questionnaire automation tools in the next quarter?

Based on your responses in this survey, what would make automation of vendor security questionnaires most valuable for your team?

We'd like to explore a few of your responses in more depth. An AI moderator will ask up to 2 follow-up questions based on your answers.

What is your primary role?

• Security / GRC / Risk
• IT / Infrastructure
• Procurement / Sourcing
• Legal / Privacy
• Sales / Account Management
• Operations / PMO
• Executive / Leadership
• Other (please specify)

How many years have you worked with vendor security questionnaires?

• Less than 1 year
• 1–2 years
• 3–5 years
• 6–10 years
• More than 10 years

Which region do you primarily work in?

• Americas
• EMEA
• APAC
• Other / Multiple regions

Thank you for completing this survey. Your input will directly inform how we prioritize improvements to our vendor security questionnaire processes.