Why the security review ritual is broken, and what it actually looks like to earn vendor trust
Every vendor in security claims their customers trust them. The 891-question security questionnaire sitting in someone’s inbox says otherwise.
The third-party risk review process was built on a reasonable premise: before you hand sensitive data or critical infrastructure over to a vendor, you should have some confidence they’re doing what they say they’re doing. What it became, in practice, is something closer to a paper trail — a ritual that transfers liability without producing confidence, and burns enormous amounts of time on both sides of the transaction while solving almost nothing.
The vendors and practitioners who’ve been thinking hardest about this problem have arrived at a common conclusion: Trust between vendors and customers isn’t a questionnaire problem. It’s a visibility problem. You can’t trust what you can’t see. And for most of the industry, the security posture of your vendors is still something you have to ask about, periodically, reactively, with a spreadsheet.
Three conversations from our past ‘Security You Should Know’ episodes point toward what changes when that model breaks down — and what it looks like to build something better.
The questionnaire is a symptom
Steve Gentry spent years as a CSO fielding security reviews. He’s also the one who named the 891-question questionnaire — not as hyperbole, but as an actual artifact from his career. When he described what went wrong with third-party risk management, he didn’t blame the tools. He blamed the underlying assumption.
“Third-party risk management started off with noble intent. The point of doing security reviews was you’re trying to build trust with your customers. The problem is we realized that ‘trust but can’t verify’ was so inherent in this process that people freaked out — and so they overextend.” — Steve Gentry, former CSO
Conveyor’s approach is to treat this as a revenue problem as much as a security problem. Chris Gomes, Conveyor’s head of product, frames the pitch to a CEO plainly: this shortens sales cycles, not just questionnaire queues. But the more important point isn’t about speed. It’s about making every answer auditable. That’s the difference between a faster questionnaire and a trust artifact.
“We are all about the guardrails and observability that are in place so that you know our AI agent is operating within the boundaries that you define. It’s also about observability — being able to audit and see every decision that she’s made. That tends to provide a lot of assurance.” — Chris Gomes, head of product, Conveyor
Gentry also noted that in his own experience implementing trust centers, he’s seen over 85 percent reductions in the time his team spent on security questionnaires — not because the questions went away, but because the answers were already visible before anyone had to ask.
Listen to the full episode ->Build Customer Trust with Conveyor
Reactive trust is not trust
“We’ve been talking about customer trust in security for more than a decade. Every vendor puts it on a slide. Every CEO puts it in a board deck. So why are we still talking about it? I think we’ve had challenges in actually solving it.” — Terry O’Daniel, former CISO
The core rubric for assessing trust hasn’t actually changed. We’ve mailed spreadsheets, then emailed PDFs, then built portals — but the underlying dynamic is still reactive. A customer asks. A vendor responds. The response is static. By the time the next security review arrives, the posture it described is already six months stale.
Safebase’s argument is that the model needs to invert: instead of producing trust evidence only when asked, vendors should surface it continuously. The trust center isn’t a better response to the questionnaire. It’s a way of making the questionnaire unnecessary. And when that security information lives where salespeople already work — Salesforce, Slack, the go-to-market stack — security stops being a bottleneck in the deal process and starts being a competitive advantage.
“Helping GRC and security teams is one thing. Enabling them by putting what you’ve done into the hands of the go-to-market team — that’s the nuance we unlocked early on.” — Al Yang, CEO & co-founder, Safebase
Dan Holden, CISO at Commerce, put the cultural shift plainly: “It’s security’s job not to introduce walls into the sales process.” That’s not a concession to sales. It’s a description of what a trusted security team actually looks like from the outside.
Listen to the full episode ->Turning Trust into a Growth Engine with SafeBase by Drata
Compliance isn’t trust. Continuous evidence is.
Matt Hillary, Drata’s CISO, described getting a clean SOC 2 Type 2 report as “a celebration of an ongoing commitment” — the beginning of a demonstration, not the end of one. Mike Lockhart, CISO at EagleView, put the problem plainly:
“There’s a large delta between intent and execution. Policy is your intent — how you desire an organization to operate. Execution is where it becomes really difficult. How do you take your intent and prove that in execution?” — Mike Lockhart, CISO, EagleView
What Drata builds is the evidence layer that makes continuous proof possible at scale. It pulls real-time data from integrated systems, maps it to frameworks, and surfaces gaps before they become audit findings.
“GRC isn’t just about checking boxes anymore. It’s really the currency of trust between organizations. Our customers and partners expect ongoing, real-time assurance that our business is secure and operating reliably and with integrity.” — Matt Hillary, CISO, Drata
Currency only works if it’s current. A SOC 2 from eighteen months ago isn’t a trust signal. It’s a historical document. Continuous evidence, updated in real time, is the thing that actually lets a vendor say: here is what we do, and here is proof that we’re doing it right now.
Listen to the full episode ->Proving Trust with Drata
What these three conversations have in common
None of these episodes are really about software. They’re about the same underlying problem: the gap between what vendors claim about their security posture and what customers can actually verify.
Conveyor is closing that gap at the questionnaire layer. Responses are faster, more accurate, and auditable. Safebase is closing it at the relationship layer. Posture becomes visible continuously rather than on request. And both Safebase and Drata — different products on the same platform — are closing it at the evidence layer. The distance between policy and execution becomes measurable in real time.
What they share is a rejection of the ritual. The security review as checkbox, the compliance report as destination, the questionnaire as trust proxy: all three conversations push back on the same assumption: that trust is something you demonstrate once, when asked, and then move on. The vendors and practitioners who’ve figured this out are treating trust as an operational state, not a deliverable.
That shift has a business consequence. Organizations that can show their security posture in real time — not just report on it retrospectively — move faster, close deals more easily, and earn a kind of credibility that no questionnaire can manufacture.
Got feedback? Join the conversation on LinkedIn.
Coming in April: Trust Month on Super Cyber Friday
The vendor trust problem is just one dimension of a much larger conversation the CISO Series is dedicating an entire month to. This April, all four Friday Super Cyber Friday live episodes will explore trust from different angles:
April 3 — Hacking Trust in Leadership: What does it take to build trust with your own team as a security leader?
April 10 — Hacking Trust with Vendors: How do you tell a true partner from a vendor you merely tolerate? What earns trust before and after the contract is signed?
April 17 — Hacking AI Trust: Can you apply the same trust-building frameworks you use for humans to LLMs? What does it take for AI to earn a meaningful role in security operations?
April 24 — Hacking Trust in Security: How do security teams move from cost center to trusted organizational partner?
Join us live every Friday in April.
>>> REGISTER for single episodes or the whole Super Cyber Friday series <<<