# The Vendor Risk Questionnaire Is Broken

URL: https://www.deepinfo.com/blog/the-vendor-risk-questionnaire-is-broken/

Third-party risk

## The Vendor Risk Questionnaire Is Broken. Here’s What Monitoring Shows.

Annual vendor questionnaires produce paperwork. Continuous external monitoring is how a third-party risk program gets the evidence back.

Deepinfo · Published 2026-06-12 · 4 min

Most vendor risk programs started the same way. Questionnaires go out once a year, vendors return answers, the risk team files them, and the next audit uses the filed answers as evidence.

The process is familiar, and it is structurally broken. A questionnaire records what a vendor says about its security posture. Its external posture can show something else, and the gap between the two is where vendor risk lives.

Run continuous external monitoring against a vendor portfolio and four patterns come up again and again.

### Four Claims Monitoring Can Test

#### “We Patch Promptly”

External scanning fingerprints the software on a vendor’s internet-facing assets and matches each version to known CVEs, and the result often differs from the answer on file. CVEs listed in CISA’s Known Exploited Vulnerabilities catalog, or rated likely to be exploited by EPSS, stay open on vendor infrastructure long after a questionnaire described patching as prompt.

#### “Our Perimeter Is Strong”

Scanning surfaces login pages exposed to the internet, expired certificates, end-of-life software and subdomains nobody maintains. The questionnaire didn’t ask about them, and the vendor didn’t volunteer them.

#### “We Monitor Our Attack Surface”

Scanning finds assets that aren’t in the vendor’s own inventory: acquired infrastructure, shadow IT, campaign microsites. We see these patterns [on the customer side](https://www.deepinfo.com/blog/the-attack-surface-you-dont-know-you-own/) too. The vendor’s monitoring is honest about the inventory it knows and blind to the inventory it doesn’t, and so are its questionnaire answers.

#### “Our Incident Response Is Mature”

External monitoring can’t see inside a vendor’s incident response. It can see what changes on the vendor’s perimeter: a certificate replaced without notice, a new open port, a DNS record that now points somewhere else, a security score that drops between scans. An annual questionnaire runs on a different clock from the events it is supposed to describe.

### What Continuous Monitoring Changes

Vendors aren’t lying on questionnaires. A questionnaire is a self-report with a long delay, and by the time the answers are filed they describe a posture that has already moved.

|  | Annual questionnaire | Continuous external monitoring |
| --- | --- | --- |
| Source | What the vendor reports | What the vendor’s internet-facing assets show |
| Cadence | Once a year | Every scan |
| Scope | The inventory the vendor knows | Also the assets the vendor didn’t list |
| Scale | Analyst time grows with each vendor | Scanning is the platform’s job; review effort follows the findings |
| Record | A filed answer | Findings with states and history |

Two rows in that table matter most once a portfolio grows. The first is scale: the platform does the scanning, even for the hundredth vendor. What grows with the portfolio is the number of findings to review, and one scoring scale across all vendors decides which get reviewed first.

The second is the record. Each finding carries its history and its state, so an auditor’s question about a vendor can be answered from the record instead of from a new round of emails.

### What Happens to the Questionnaire

The questionnaire doesn’t disappear. It becomes a confirmatory and contractual layer rather than the primary source of evidence. Specific commitments, such as data handling, incident notification and access control, still belong in the contract.

Monitoring underneath provides continuous evidence that those commitments are being honored, at least where they show from the outside. In the Deepinfo Platform, [Third-Party Risk Management](https://www.deepinfo.com/platform/tprm/) runs the engine that watches your attack surface on each vendor: a portfolio per third party, with the same data layers and scoring.

For a team rebuilding a vendor risk program, the practical decision is how quickly to make monitoring the primary evidence source, and to move the questionnaire back to the role it can play.

### Third Parties Graded on One Scale.

A vendor portfolio scanned as thoroughly as your own assets and graded the same way. The vendor that slipped is the one to review first.

### Where to Read Next.

- [The attack surface you don’t know you own](https://www.deepinfo.com/blog/the-attack-surface-you-dont-know-you-own/) (Blog · 2026-05-29): The five inventory patterns, on your own side of the contract.
- [CTEM is a workflow, not a product category](https://www.deepinfo.com/blog/ctem-is-not-a-product-category/) (Blog · 2026-05-15): Third parties belong in the scoping stage with everything else.
- [Continuous Monitoring](https://www.deepinfo.com/platform/tprm/continuous-monitoring/) (Third-Party Risk Management): Vendors rescanned on the platform’s schedule, with history.

### Scan Your Vendors the Way You Scan Yourself.

Book a demo of Third-Party Risk Management on a few of your suppliers.

[Request demo](https://www.deepinfo.com/request-demo/)