When a company with no security team sells to a bigger customer, a security questionnaire usually shows up late in the deal: 100 to 300 questions, often an Excel file, sometimes a portal.
I'm curious how people actually deal with this:
- Who ends up answering them (founder, CTO, sales engineer, a consultant)? - Do you keep a bank of past answers, or start from the last questionnaire each time? - What question did you not know how to answer honestly (SOC 2, pen test, MFA, AI usage)? - Did a questionnaire ever cost you a deal or delay one by weeks?
For disclosure: I'm building a tool in this space (I'm the founder), so I'm asking partly to learn what's actually painful. I'm not going to pitch anything in the thread. Stories from the buyer side are just as welcome: what makes a vendor's answers believable to you?
Comments URL: https://news.ycombinator.com/item?id=50439770
Points: 1
# Comments: 1
