The last time most security teams meaningfully changed how they respond to vendor questionnaires was 2019, when SIG Lite and CAIQ were the two documents you saw most weeks. Since then, portal-based assessments have exploded, mid-market buyers have started asking enterprise-level questions, and the typical SaaS vendor fills out a new questionnaire every couple of weeks. TPRM programs that used to live in a single spreadsheet now need to answer to procurement, legal, and security simultaneously.
The process, meanwhile, is the same shared inbox with the same spreadsheet.
The numbers behind the slowdown
We surveyed 142 security leaders at companies between five and four hundred million in ARR; here are the median data points from that cohort.
- Questionnaires received per quarter: 24 (up from 8 in 2022)
- Hours per questionnaire: 9.4 (down from 11, but only because teams are cutting corners)
- Deals where security response was on the critical path: 38% (up from 22%)
- Deals lost or slipped due to a slow questionnaire turnaround: 11%
Three root causes
The same root causes have lived here since 2019, but volume growth has multiplied each one and pushed all three from "manageable" to "deal-breaking."
These aren't surprising — they're the same issues every security leader names when asked. What's changed is the volume that makes each one bite harder.
Volume growth outpaces headcount
Questionnaire volume has at least doubled since 2022 (the Whistic 2025 TPRM Impact Report measured a 26 percent year-over-year jump on its own, and our customer-base sample shows the cumulative shift is steeper). Security headcount has not kept pace. Math does not math.
The same answers, over and over
In our customer base, the large majority of questions on any given questionnaire have been answered before, often in a previous questionnaire the same team filled out three weeks ago. But the answers live in PDFs, shared drives, and Slack threads. Nothing indexes them.
Lost context between questionnaires
The one customer-specific detail that did differ between two assessments (say, a scoped data residency statement for a German prospect) is the exact thing that's easy to mis-apply on the next one. Context collapse is how you end up with contradictory answers in the wild.
What's actually changing
Two structural shifts matter more than any individual tool, and they reframe the work from a one-off task into a continuous integration problem.
- Questionnaires are becoming source-of-truth queries. When a buyer's portal pulls the same three answers from your SOC 2 report, your trust center, and your security page, they want consistency — and they notice when you don't have it.
- AI responders are moving toward graduated autonomy with documented escalation. The 2024 version of questionnaire AI drafted answers for a human to review item-by-item. The 2026 version drafts the bulk, escalates flagged items, and a named human signs off before submission.
Where to start this quarter
The highest-leverage move is consolidating your three most common questionnaire sources into one knowledge base before reaching for any AI tool.
If you're going to do one thing: pick your three most common questionnaire sources (SIG, CAIQ, a customer portal you see monthly) and build a single knowledge base they all pull from. The ROI on consolidation is higher than the ROI on any specific tool — and it's the prerequisite for every AI workflow you'd want on top of it.
For more, see our SOC 2 questionnaire checklist — the practical companion to this piece — and the TPRM glossary entry for definitions of the recurring acronyms. If you want to skip directly to the working version, Evident automates this end to end.