Customer security reviews often miss their mark, leaving organizations scrambling to compensate with extensive questionnaires that divert attention away from genuine risk management. The inconsistency of these processes and the lack of clear authority or visibility contribute to prolonged timelines and increased frustration. So, how can companies maintain trust without drowning in the complex processes that come with these reviews?

In this episode, Chris Gomes, head of product at Conveyor, discusses how they automate the response to security questionnaires and focus on relieving the burden on customer trust offices overwhelmed by extensive review processes. Chris is joined by our panelists, Steve Gentry, advisor at Cognate Cyber, and Eduardo Ortiz-Romeu, vp, global head of cybersecurity at Techtronic Industries.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Conveyor

Full Transcript

[Voiceover] Connecting security solutions with security leaders. Security You Should Know starts now.

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re talking about Conveyor and how they are helping to build customer trust. Now, the problem they’re addressing is customer security reviews, that old industry headache that we all know so well. Helping us to get answers to these questions are Steve Gentry, former CSO at Clari, and Eduardo Ortiz-Romeu, VP and global head of cybersecurity at Techtronic Industries.

So, Steve, I’m going to start with you. Why are customer security reviews still a problem?

[Steve Gentry] Third-party risk management started off with noble intent. The point of doing security reviews and getting reviewed was, again, you’re trying to build trust with your customers, but you’re also trying to find where you may have risk in your environment. The problem with third-party risk management in this space is the security reviews is we realized that trust but can’t verify was so inherent in this process that people freaked out, and so, they overextend.

So, the next thing you know, you have these 891 questionnaires, which is a real questionnaire that I’ve gotten in the past, and we’re trying to go overboard to compensate for this instead of focusing internally about how this product shows risk or how we’re accepting risk. It’s focused all on that transfer.

We got to do this questionnaire to say, “Hey, we’ve done a review. SolarWinds is fine. Microsoft is fine. All of these things are fine.” And so, we just, we have focused and moved away from the intent on managing risk to how do we transfer it to this vendor that we’re looking at.

[Rich Stroffolino] All right, Eduardo, I’m going to throw it to you. Why are we still struggling with customer security reviews?

[Eduardo Ortiz-Romeu] From my opinion, it’s mostly an inconsistent process, right? Adding to what was said, we’ve been adding, okay, let’s go with vendor risk management first, compliance risk, financial risk, operational risk, reputational risk, cybersecurity risk, legal risk. So, we find out when we are even sending it out or receiving it, it’s always an inconsistent process, and there’s really a lack of visibility, lack of authority in that process on both sides.

So, I’ve been dreaming about a framework about how to go about this portion of our programming in order to be more effective.

[Rich Stroffolino] All right, well, I think we have an understanding of the problems, so let’s talk about some solutions. Today, we’re going to be talking to Chris Gomes, head of product from Conveyor. So, Chris, help us out here. Let’s start out with three essential questions. First up, how do I explain the value of your solution to my CEO?

What does your solution do and what does it not do? And you got to give us that pricing model. So, set us up with these preliminaries.

[Chris Gomes] The short answer to how you explain the value to your CEO is easy. I have a solution that will help us grow top-line revenue by shortening sales cycles. Should be music to your CEO’s ears because as a vendor receiving these security questionnaires, you almost certainly have a customer trust office that is completely underwater with these responses.

Like Steve said, we’re talking 891 questionnaires. It ends up being a resource drain, not a great use of people’s time, and worst off, the sales team and customer-facing teams are starting to get antsy because we’re seeing that it’s taking longer and longer to support these requests. So, what we do, we offer the world’s first AI agent for customer trust that can service these customer-facing requests end-to-end.

What we do not do, we don’t do anything on the third-party risk management side. So, we’re not involved in, say, issuing security questionnaires, but rather in responding to them, and we price based on outcomes.

[Rich Stroffolino] Excellent, all right. So, we’ve gotten those preliminaries out of the way, some really great background information, but I’m sure Eduardo and Steve, you both have a lot of questions here. So, let’s start with you, Eduardo. What other questions do you have about Conveyor?

[Eduardo Ortiz-Romeu] So, my main question is, how does it work from an implementation? If I’m the receiving end or if I’m using it for my external, that’s where my confusion is. How does it really work from both sides?

[Chris Gomes] Yeah, great question. So, our AI agent for customer trust, lovingly named Sue, she will typically integrate into your queue. So, if you have a trust assurance or customer trust office where they have a queue, where they receive requests from the sales team, like, “Hey, can we complete this questionnaire?

I’ve got a million-dollar deal. Can you get it done yesterday?” Sue will just pick up that request directly from your queue, triage it, answer the questionnaire, run it past your team to make sure everything looks good, and then send it back to your seller, and then they’ll get it back to the customer.

But Sue can also be deployed in a trust center that’s actually customer facing, and I’m happy to say more about that as well.

[Eduardo Ortiz-Romeu] Okay, so my follow-up question in this case, so you have a list of integrations with other systems in order to make that process happen?

[Chris Gomes] That’s correct.

[Eduardo Ortiz-Romeu] Okay.

[Rich Stroffolino] All right, well, Steve, what questions do you have for Conveyor?

[Steve Gentry] So, garbage in, garbage out has been a problem longer than security programs has existed, going back to even in my earlier days in IT in the ’80s. What criteria have you seen out of customers who have successfully implemented Conveyor? Like what does that success criteria look like? What processes have they implemented internally to make sure they’re getting the most out of this to ensure that it’s not a garbage in, garbage out scenario?

[Chris Gomes] Yeah, great question. So, for us and our customers, accuracy is paramount. Sue is never making up answers to these questions. She’s answering based on your knowledge base, which is typically driven by integrations into your sources of truth. So, you essentially point Sue to your security documentation, a SOC 2, a SIG, a CAKE, and she’s using that content to then respond to these questionnaires.

And we have monitoring in place so that over time, you can see and keep an eye on how accurate Sue’s responses are. So, that’s basically paramount and foundational, but really the North Star metric that we help our customers and customer trust offices address is how quickly can we turn these around?

Can we meet our SLA for satisfying customer-facing requests? And so, that’s ultimately the North Star to know that Sue’s working.

[Steve Gentry] So, I got a quick follow-up on that one as well. So, would you say that having an internal process to do regular content review would be paramount for keeping Sue accurate? Because over time, companies change. They grow, they expand, or they shrink as we’ve had happen over the last few years, rather.

So, would you say that having that review process on a quarterly, semi-annual basis is paramount for a successful implementation? Otherwise, Sue is going to start responding more often with answers that are inaccurate?

[Chris Gomes] Yes. And the one thing that we’ve seen happens a lot is people say, “Okay, great. We’ve got this tool where we’re going to build a knowledge library,” and we pinky swear that we’re going to keep it up to date, and it never happens because nobody is going to be doing that as frequently enough of a basis.

And that’s why our solution actually is built on these integrations with your sources of truth, places where you are already maintaining content. You could even plug it into, say, your public-facing product documentation. And so, you get more mileage out of those resources that you’re already maintaining, and that’s how we deliver the highest accuracy with the least amount of maintenance.

[Eduardo Ortiz-Romeu] So, great. Actually, that’s a great point, Steve. I was thinking of have you, Chris, have you guys seen, been in the case where you’re already on board with a customer, but the garbage in, garbage out is present. There’s no real processes. They actually have to, “Okay, I cannot use Sue at the moment because I need to fix this.” Is that the case?

And are you guys really [Laughter] clear with customers in terms of the requirements at the beginning of the sales process?

[Chris Gomes] We do have the benefit of typically we’re serving large, complex organizations with strong audit programs. And so, there’s typically not a lack of resources at the company. Hey, we’re jumping through all these hoops anyway. We have all these audit certifications and these frameworks and these standard questionnaires that we complete on a regular basis, and we say, “Great, let’s use that.” Forget the library from your previous tool.

That has sort of evolved into garbage. We don’t want to import that. Let’s use these artifacts that you’re already going…these third-party artifacts. However, we do also have the benefit of having seen a lot of security questionnaires and we can provide guidance around, “Hey, here are the types of questions that are most common,” if they do truly need to build a content library from scratch.

[Steve Gentry] I’m also going to jump in on this follow-up question again. It always makes me chuckle when you have someone who’s in the technology space like IT, security, engineering, and the amount of fearmongering that can come out of that space around AI. So, how are you guys helping? Like, you’re like, “Hey, we have Sue, this AI assistant.” How are you helping customers overcome some of that fearmongering mentality that happens?

Because I’m still baffled as I get hit with this during conversations with CISOs of like, “Oh, I just don’t trust AI, I can’t do it.” Like, literally a lot of it is going to come back to the garbage in, garbage out, but what are you doing at Conveyor to help customers get past that through the sales cycle as it comes up?

[Eduardo Ortiz-Romeu] Yeah, and you should sell that as well. [Laughter] It’s a big problem for everyone around.

[Chris Gomes] It’s a great question, and I have been on a lot of calls with CISOs who are considering Conveyor, and I need to address their concerns around data protection, training of the models, what the AI does and does not have access to. And I would say two things. First of all, we are all about the guardrails and observability that are in place so that you know Sue, our AI agent, is operating within the boundaries that you define.

And it’s also about observability, being able to audit and see every decision that she’s made. Where did she get this answer from? Why did she reason through this request in that way? And that tends to provide a lot of assurance. The second thing I would say is, in 2025, I’m having fewer of those conversations because CISOs are being asked not, “Hey, how are you securing these AI products,” but rather, “How are you using AI to enable the business?” It’s now we’re getting CISOs who have mandates to actually find and deploy AI products.

And so, the conversation tone has definitely changed.

[Eduardo Ortiz-Romeu] Okay, I do have one question after the series of questions. Full deployment time, what’s a realistic one in a regular, let’s say, 10,000-employee organization? I know employees don’t have a relationship to this, but what’s your typical deployment time?

[Chris Gomes] So, we really have two products. We have this internal-facing questionnaire automation tool where the AI agent is really working within the bounds of your organization. And then our second product is a trust center where you can actually have the AI agent interacting directly with customers.

The first product, typical deployment time is under 30 days. It’s very fast to get the content library set up, and then it’s really just about those integrations so the AI agent is working in your systems of record. And sometimes those integrations have to go through approval processes, but actually time to value, we do a two-week free trial, and we have customers who see value in the context of those two weeks.

For the second product, the trust center, that’s typically a customer-facing resource being hosted on your marketing website, and that involves some more stakeholder alignment. You want marketing and legal and everyone to turn the keys at the same time. And so, that’s where you typically see it closer to, say, 60 days.

[Eduardo Ortiz-Romeu] Okay, and typically, a follow-up, where do you see this product falling into? Because we’re cyber, but does it fall more under GRC, legal? You even mentioned marketing at one point. Who typically owns this portion of, or actually, it might have two owners at that point for the two products.

[Chris Gomes] It’s a great question. Typically, we are working with teams within GRC, and it might be, say, a customer trust or trust assurance team, sometimes reporting directly to a chief trust officer or to a CISO. I will say we also get a lot of overlap with sales engineering, sales enablement teams.

And typically question like, does your product have SSO? Hey, that’s more of a product functionality type of question for a sales engineer. Do you use SSO internally? That’s more of a question that you’d see on a security questionnaire about your organizational controls. So, typically we are in the customer trust or trust assurance or GRC under the CISO, although we do work hand in hand with sales engineers, sales architects, sales enablement.

[Eduardo Ortiz-Romeu] Okay, thanks.

[Steve Gentry] Yeah, I’m a big fan of trust centers, by the way. I started implementing them, it’s been about seven years now since the first time I implemented a trust center, and I’ve seen just great value of driving that transparency with customers. Going back to my previous statement that you talked about what Sue is doing and how she is handling.

So, do you have an AI transparency statement as part of your own trust center to help with that conversation? Just something you’re publishing out there being clear about what you’re doing with that data, because a lot of the questions isn’t about AI good or bad. It’s like AI is taking personal data and it’s being trained back at it, and they’re LLM.

Is it something that you’re transparent about at Conveyor?

[Chris Gomes] Exactly, we dogfood our own product. We use Conveyor, of course, to host our own trust center. And I will tell you our safe use of AI is one of our most frequently accessed resources. And it’s funny how it works because a customer when evaluating Conveyor, of course, they put us through their own security review process, and then they say, “Ooh, I kind of like that AI white paper.

I’m going to crib from it and put something similar in my own trust center.” So, it’s really a beneficial loop.

[Steve Gentry] That’s fantastic.

[Eduardo Ortiz-Romeu] Steve, actually a question is a little bit more directed to you. Do you see a lot of companies out there with trust centers? When I bring this topic, a lot of times it doesn’t. So, I was excited to see Conveyor because oh, okay, this is addressing something that might be missing by itself in a lot of organizations.

[Steve Gentry] Yeah, so I have seen this more and more. One of the biggest problems I’ve seen is a lot of companies implementing a tool and the tools not talking to each other. But from the trust center aspect, this is something, especially in the SaaS world, I have seen a lot more of over the last few years, Conveyor being one of the players in the market, but there are others out there that have been doing really well.

One of them just got acquired by another company. So, this is a space that we’re all looking at. Like, so I, just as an example, I’m getting like 85%-plus reduction in security questionnaires or time spent by my teams by implementing trust centers because it’s getting that documentation out in front of our customers and saying, one, working with sales and sales engineers, if they’re not over this threshold, I’m not going to answer their 500-question questionnaire that’s a $10,000 deal.

But yeah, there’s definitely been value out there that I’ve seen, and I’m seeing it more common. I just see it more in the SaaS space. I got my final question out there of, this is for both of you. What is your argument for killing the statement, “Compliance does not equal security”? I hate this statement, by the way.

[Eduardo Ortiz-Romeu] Compliance is there for a reason, right? To, in some cases, unfortunately, force you to be more secure and comply with controls that are going to protect your customers in that case, right? I hate the term because you have to abide. Otherwise, if we didn’t comply with a lot of regulations, we’ll be getting a lot more lawsuits, for example.

Legal backs me up all the time with that statement. We need compliance and legal is my biggest ally in that sense, and we kind of like match up in order to beat those stigmas out there. How about you, Chris?

[Chris Gomes] Yeah, great answer. For us, it’s all at the end of the day about trust, and we like to say, the best way to be perceived as secure is to be secure. There are certain compliance specific hoops that we’ll always have to jump through, but if you start with a strong security program, then it’s really not that far of a stretch to then communicate that to the market.

[Rich Stroffolino] All right. Well, Chris, what’s one thing we didn’t ask about that we need to know about Conveyor?

[Chris Gomes] I would just say that with an AI agent, we are no longer solving part of the process. We are solving the entire process end to end. So, for example, I mean, like a seller on your team gets a security questionnaire from a customer, throws it into the queue for the customer trust team. Sue immediately gets to work.

She can respond back if the seller forgot to provide a password to the questionnaire. She can chat with the seller, get what she needs, then draft that first set of answers, figure out, “Hey, I couldn’t answer this question, so I’m going to delegate it out to this team.” She can reason through all those decisions.

So, you’re no longer just looking at a point solution. There have been point solutions and trust centers, as Steve mentioned, for parts of this process, but an AI agent truly unlocks solving this problem end to end and getting your team out of their queue so they can do more strategic work and focus on building relationships with key customers.

[Rich Stroffolino] Well, that’s about all the time we have for this episode of Security You Should Know. If you want to learn more about Conveyor, head on over to conveyor.com. A big thank you to our panelists today, Eduardo Ortiz-Romeu and Steve Gentry for helping us learn more about the solution and just a fantastic conversation.

And I want to take a moment to thank Chris Gomes, head of product for Conveyor, for his time in answering all of these great questions. And thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on ciso-dev.davidspark.dcgws.com or just email us at info@ciso-dev.davidspark.dcgws.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.