TL;DR: Static vendor questionnaires no longer capture real third-party risk for most security programmes, and Panorays’ 2026 CISO Survey for Third-Party Cyber Risk Management Priorities found that 71% of CISOs say they fall short while 66% have adopted AI-powered alternatives. Periodic checkbox reviews cannot keep pace with shifting vendor dependencies, so continuous validation becomes more important than documentation.
At a glance
What this is: This survey says static vendor questionnaires are no longer trusted as the primary way to assess third-party cyber risk, with most CISOs reporting that they miss real-world exposure.
Why it matters: It matters because IAM, vendor access, and non-human identity governance all depend on knowing which third parties can still act, connect, or change after onboarding.
By the numbers:
- 71% of CISOs say traditional questionnaires fall short in capturing real third-party risk.
- 66% of CISOs have now adopted AI-powered alternatives to streamline assessments.
Context
Vendor security questionnaires were designed for a slower, more static supplier model, not for supply chains where access, integrations, and dependencies shift continuously. They still have value as a baseline control, but they do not provide real-time assurance across nested vendors, subcontractors, and connected systems. The practical gap is visibility, not paperwork.
That gap becomes more serious where third parties are granted access through service accounts, tokens, APIs, or delegated workflows. In those cases, the security question is not whether a form was completed, but whether the organisation can still see and govern the access that the third party actually uses.
Key questions
Q: What breaks when third-party risk questionnaires are the only vendor control check?
A: They create a snapshot of declared controls, but they do not verify enforcement, evidence freshness, or whether access was removed when the vendor relationship changed. That leaves organisations with documented trust instead of controlled trust, which is especially risky when vendors hold privileged or non-human access to sensitive systems.
Q: Why do static questionnaires create a false sense of third-party security?
A: Because they document answers rather than observe behaviour. Security teams may believe they have covered risk once the form is complete, but the vendor’s actual posture can drift through configuration changes, new dependencies, or access expansion. The control feels complete while the risk surface keeps moving.
Q: How should security teams assess third-party cyber risk beyond questionnaires?
A: They should measure real access first. Start by mapping which data, systems, and identity paths each vendor can reach, then validate controls with evidence such as permissions snapshots, authentication logs, and credential inventories. A vendor that can touch sensitive data deserves continuous monitoring, not a one-time score, because exposure can change after onboarding.
Q: When should organisations prioritise continuous vendor monitoring over annual assessments?
A: Organisations should prioritise continuous monitoring when vendors can access systems, data, or integrations that would create operational or regulatory impact if posture changed. Annual assessments are too slow for active supplier ecosystems. Continuous monitoring is most valuable when the risk of delayed detection exceeds the cost of automation.
Technical breakdown
Why static questionnaires fail in dynamic supply chains
Traditional questionnaires are point-in-time instruments. They collect self-attested answers, often during onboarding or annual review, but they do not observe whether the vendor’s environment, permissions, or subcontractor dependencies have changed since the last submission. That makes them useful for governance evidence and weak for operational assurance. In complex supplier ecosystems, the risk is not only inaccurate answers. It is also stale answers that were once true but no longer reflect the live security posture. Practical implication: treat questionnaires as intake evidence, not as a continuing control. See the Third-Party Risk Management Guide.
Practical implication: Use questionnaires as evidence of due diligence, then add continuous checks for changes in vendor access and exposure.
How AI changes third-party assessment workflows
AI-assisted assessment tools reduce the manual overhead of extracting, normalising, and comparing vendor responses. That matters because many questionnaire failures are process failures, not just control failures: inconsistent answers, missed follow-ups, and delayed reviews all create blind spots. AI does not remove the need for judgment, but it can prioritise what needs review, flag anomalies across submissions, and surface patterns that humans would miss at scale. Practical implication: use automation to compress review time, not to remove validation from the workflow.
Practical implication: Deploy automation to triage responses and highlight exceptions, then reserve human review for material risk decisions.
Why continuous monitoring matters more than periodic review
Continuous monitoring changes the model from document collection to risk observation. Instead of asking a vendor once a year whether it is safe, the organisation looks for changes in the vendor’s posture, access patterns, or dependencies that could alter the risk picture. This is especially relevant where third parties connect through cloud services, APIs, or non-human identities, because those relationships can drift without a formal reapproval cycle. Practical implication: define what evidence must be monitored continuously rather than only requested periodically. Read the Ultimate Guide to NHIs: Key Challenges and Risks.
Practical implication: Monitor vendor exposure and access drift continuously when third parties connect through systems, APIs, or NHIs.
Threat narrative
Attacker objective: Exploit stale third-party trust to reach systems, data, or downstream suppliers that the organisation still believes are adequately controlled.
- Entry begins when a third party is trusted through a questionnaire-based onboarding process that does not verify the live security state behind the answers.
- Escalation occurs when stale vendor approvals or nested supplier access remain in place after the underlying risk has changed.
- Impact follows when the organisation discovers that compliance evidence did not prevent exposure, leaving real third-party access and dependencies insufficiently governed.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
- Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Static questionnaires are a governance artefact, not a risk control. They can show that a supplier answered questions at a moment in time, but they cannot prove the supplier still has the same posture, dependencies, or access profile today. That distinction matters because modern third-party risk is dynamic, not annual. Practitioner conclusion: assess questionnaires as evidence, but do not mistake them for assurance.
Third-party risk now includes the governance gap between declared and actual access. The most important question is often not whether a vendor passed review, but whether its live access, subcontractors, and connected systems still match the approved risk boundary. That is where questionnaire-driven programmes tend to fail. Practitioner conclusion: govern the boundary, not just the form.
AI-driven assessment is becoming a control-support layer, not a replacement for ownership. Automation can reduce inconsistency and free analysts from repetitive collection work, but it does not answer who owns risk acceptance, offboarding, or change detection. That ownership problem is the same one that appears in third-party risk management more broadly. Practitioner conclusion: automate evidence handling, but keep accountability with the security and vendor-risk owners.
Questionnaire fatigue: the repeated-use of static vendor forms creates a false sense of coverage while real exposure moves elsewhere. This is now a structural issue in supply-chain governance because teams spend time validating statements instead of observing change. The result is slower response, weaker prioritisation, and more missed dependency drift. Practitioner conclusion: replace periodic assurance theatre with evidence that tracks change over time.
Identity governance extends beyond internal users when third parties are granted machine access. Tokens, service accounts, APIs, and delegated workflows can create enduring trust even when the vendor relationship has changed. That is why questionnaire data needs to connect to non-human identity risk and access lifecycle controls. Practitioner conclusion: include third-party non-human access in your governance model, not just in your procurement checklist.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: Third-Party Risk Management Guide
What this signals
Static questionnaire programmes are increasingly a record-keeping exercise rather than a control that meaningfully tracks third-party change. The practical shift is from evidence collection to evidence verification, especially where suppliers can alter access paths without reopening the original review.
Questionnaire fatigue: the governance burden created by repeated forms and manual reconciliation now obscures the more important task of monitoring live access, subcontractor change, and downstream dependence. Organisations that still rely on periodic review will keep discovering risk only after the boundary has already moved.
For practitioners
- Replace static questionnaires with tiered assurance workflows Use the questionnaire as the first evidence step, then route higher-risk vendors into deeper review, validation, and recurring monitoring based on data sensitivity and access scope.
- Map third-party access to actual systems and identities Maintain an inventory of vendor accounts, tokens, APIs, and delegated permissions so review decisions are tied to live access rather than only to self-attested answers.
- Automate response reconciliation for recurring assessments Use automation to compare new submissions against prior answers, flag inconsistencies, and identify when a vendor’s stated controls no longer match earlier attestations.
- Escalate monitoring for vendors with downstream dependencies Prioritise continuous monitoring for suppliers whose access or services can propagate risk through subcontractors, integrations, or shared platforms.
Key takeaways
- Traditional vendor questionnaires expose a governance gap when suppliers, integrations, and access paths change faster than periodic reviews.
- The article highlights that 71% of CISOs think questionnaires miss real third-party risk, while 66% are already moving toward AI-assisted alternatives.
- The practical response is to keep questionnaires as intake evidence, then add continuous monitoring, access inventory, and escalation for higher-risk third parties.
Related NHI Mgmt Group resources: Third-Party Risk Management Guide · Ultimate Guide to NHIs: Key Challenges and Risks · Security Questionnaires Guide · BeyondTrust breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, CIS Controls v8 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Third-party questionnaires fail where vendor accounts and access are not continuously governed. |
| Recommendation — Track all third-party accounts under CIS-5 and review whether the access still matches current business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on whether third-party permissions and entitlements remain aligned with risk. |
| Recommendation — Apply PR.AA-05 to validate that third-party entitlements are current, justified, and bounded. | ||
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | The article explicitly discusses third-party access paths that often rely on machine identities and delegated credentials. |
| Recommendation — Map third-party tokens and delegated access to NHI-03 and monitor supplier-held credentials continuously. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Stale third-party access can be abused for credential access and movement across supplier-connected environments. |
| Recommendation — Correlate vendor-access anomalies to TA0006 and TA0008 to detect abuse of trusted third-party credentials. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Supplier governance and ongoing assurance are central to the article's third-party risk theme. |
| Recommendation — Use A.5.19 to define supplier assurance reviews that go beyond one-time questionnaires. | ||
Key terms
- Third-party risk management: Third-party risk management is the process of identifying, assessing, monitoring, and reducing risk introduced by external vendors and service providers. In identity terms, it governs who outside the organisation can reach systems or data, how that access is approved, and when it must be removed.
- Security Questionnaire: A buyer-driven set of questions used to assess a vendor’s security, privacy, and risk posture. It is usually tailored to the customer’s concerns and often asks for control descriptions, policy evidence, and operational details that support vendor due diligence.
- Continuous Monitoring: Continuous Monitoring is the ongoing evaluation of access, activity, and control state rather than a periodic snapshot. In practice, it helps teams spot privilege drift, conflicting transactions, and configuration changes before they become audit findings or operational losses.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity control to the wider security programme that depends on it.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org