Why vendor security assessments matter more now
Verizon’s 2026 Data Breach Investigations Report (May 19, 2026) found breaches involving a third party accounted for 48% of all breaches, up 60% in a year. Vulnerability exploitation became the top initial entry point at 31%. Your vendors’ patching, access control and incident response are now part of your attack surface.
Public companies must also disclose whether they have processes to oversee and identify cyber risks from third-party service providers (SEC Regulation S-K Item 106(b)(1)(iii)), and NIST CSF 2.0 puts new emphasis on governance and supply chains.
For the full vendor risk assessment process, including tiering and residual risk scoring, see Vendor Risk Assessment: Questionnaires, Evidence and Scoring. For how teams answer security questionnaires at scale, see Security Questionnaire Automation: How AI Answers Faster Without Overpromising.
What a vendor security assessment covers
A vendor security assessment is the security part of a broader vendor risk assessment. It asks whether the vendor can protect your data and keep your service running:
| Domain | Key questions |
|---|---|
| Governance | Security program, policies, leadership, independent audits |
| Access control | MFA, privileged access, access reviews, joiner-mover-leaver |
| Data protection | Encryption, data location, retention, deletion |
| Vulnerability management | Scanning, patch timelines, penetration testing |
| Incident response | Plan, testing, customer notification commitments |
| Resilience | Backups, recovery objectives, continuity tests |
| Secure development | SDLC practices, code review, dependency management |
| Subprocessors | Who else handles your data, and how they are overseen |
| AI use | Whether and how the service uses AI on your data |
Evidence to verify, and how
| Evidence | What to check |
|---|---|
| SOC 2 Type 2 report | Scope covers your service; period is recent; opinion is unqualified; exceptions and complementary user entity controls understood; bridge letter if the period ended months ago (checks summarized from PYA’s July 2026 guide) |
| ISO/IEC 27001 certificate | Scope covers the service and sites; issued against the 2022 edition (2013 certificates expired after October 31, 2025, per SGS); accredited certification body |
| CAIQ or other questionnaire | Answers consistent with the SOC report and policies; CSA’s CAIQ is a self-assessment |
| Penetration test summary | Recent, independent, scope relevant, critical findings remediated |
| CMMC status (defense supply chain) | Current status in SPRS; primes must verify subcontractors directly because DoD does not share subcontractor SPRS data, per Cooley |
| Incident history | Disclosed incidents and what changed afterward |
The most common gap is not missing evidence but evidence that does not match: a questionnaire that claims a control the SOC report shows an exception for, or a certificate that does not cover the service you buy.
Assessing AI vendors
AI features are now inside many SaaS products. IBM’s 2026 Cost of a Data Breach Report found AI-related breaches rose to 21% of breaches, and 92% of affected organizations lacked proper AI access controls, according to Baker Donelson’s summary. Add these questions:
- Does the service send our data to a model provider? Which one, and where?
- Is our data used to train or improve models?
- What prevents prompt injection and data leakage between customers?
- What permissions do AI agents or features have in our environment?
- How are model changes communicated?
The OWASP Top 10 for LLM Applications 2025 is a useful checklist for deeper review; see our AI security assessment article.
What security assessment software should do
| Capability | Why |
|---|---|
| Standard and custom questionnaires | Less back-and-forth for vendors |
| Vendor portal and document collection | One place for evidence |
| Expiry tracking (SOC periods, certificates) | Catches stale evidence |
| Document reading against criteria | Verifies answers instead of just storing files |
| Outside-in monitoring | Signals between assessments |
| Findings and remediation tracking | Follow-through |
| Source-linked outputs | Reviewers can confirm quickly |
Common weaknesses
- Accepting questionnaires without checking evidence
- Filing SOC reports without reading exceptions or CUECs
- Accepting out-of-scope or expired certificates
- Ignoring AI features added after onboarding
- Never reassessing after incidents or major changes
Vendor security assessment checklist
- Security domains in scope for the vendor’s risk tier
- SOC 2 scope, period, opinion, exceptions and CUECs reviewed
- ISO 27001 certificate scope and edition checked
- Questionnaire answers cross-checked against evidence
- Penetration test and vulnerability management evidence reviewed
- Incident notification terms in the contract
- Subprocessors identified
- AI use and data training terms reviewed
- CMMC status verified where applicable
- Reassessment triggers defined
Verify vendor security evidence with AskDona
AskDona reads the vendor’s questionnaire, SOC report, certificates, pen test summary, policies and contract together against your security criteria. It flags answers the evidence does not support, out-of-scope or expired certificates, SOC exceptions and missing AI or incident terms, and links each finding to its source page. Run a sample vendor security review on one critical vendor. AskDona shows the evidence; your security team decides.
FAQ
What is a vendor security assessment? An evaluation of whether a vendor can protect your data and services, based on questionnaires and verified evidence such as SOC 2 reports and certifications.
What should a vendor security questionnaire cover? Governance, access control, data protection, vulnerability management, incident response, resilience, secure development, subprocessors and AI use.
Is a SOC 2 report enough? Not by itself. Check scope, period, opinion, exceptions and complementary user entity controls.
How do I assess a vendor’s AI features? Ask where your data goes, whether it trains models, how prompt injection and leakage are prevented, and what permissions AI features have.
What does security assessment software do? Manages questionnaires and evidence, tracks expiry and findings, and increasingly reads documents to verify answers.
References
All pages opened and checked by October 14, 2026.
| Source | Type | Used for |
|---|---|---|
| Verizon, 2026 DBIR release (May 19, 2026) | Industry report | Third-party and entry point statistics |
| eCFR, Regulation S-K Item 106 | US regulation | Third-party disclosure |
| NIST, CSF 2.0 release (Feb 2024) | US standards agency | Governance and supply chains |
| PYA, How to Review a SOC Report (July 2026) | CPA firm guide | SOC report checks |
| SGS, ISO/IEC 27001 transition | Certification body | 2013 certificate expiry |
| CSA, CAIQ v4 | Industry body | CAIQ |
| Cooley, CMMC DFARS rule (Sept 2025) | Law firm insight | Subcontractor verification |
| Baker Donelson, IBM 2026 Cost of a Data Breach takeaways | Law firm summary | AI breach statistics |
| OWASP, Top 10 for LLM Applications 2025 | Industry project | AI vendor checklist |