Vendor security assessment that shows where the answers and the evidence disagree
A cited vendor risk rating with gaps and controls, ready to sign
See one case, screen by screen ↓Software that takes a supplier from its evidence pack — security questionnaire, SOC 2 report, pen test, policies and agreements — to a rated, signed decision. Vendor Security Assessment adds six agents that read the whole pack, score ten security domains from each source, flag every answer the independent evidence contradicts and explain residual risk, for the third-party risk analyst to decide and sign.
How to choose AI solutions for life sciences →
Updated
Drug makers hand patient data, GxP trial data and admin access to hundreds of suppliers. Before each contract or renewal, IT risk reads the vendor's SIG questionnaire, its SOC 2 Type II report, its pen-test summary, its policies, certificates, BAA and DPA, and decides whether the residual risk is acceptable. A Tier-1 review is a questionnaire of more than 600 questions and an 80–120-page audit report, read side by side by hand — about 20 analyst hours.
The dangerous gaps are contradictions. The questionnaire says MFA is enforced for 100% of privileged accounts, and Section 4 of the SOC 2 records an exception. The two statements sit in different documents, written by different people, and are found only if someone compares them line by line. Miss one and a signed approval rests on a false answer; find it late and the renewal slips, the business owner escalates and the review gets rushed.
Estimated by-hand split of about 20 hours; the hours with the solution are the ones its dashboard shows on the sample portfolio.
Six agents read the questionnaire, SOC 2 and pen test, find contradictions and rate the risk; the third-party risk analyst decides.
Velunda Trial Cloud runs clinical data capture and patient diaries for 14 studies — about 38,000 participants — and its renewal is due on Nov 15, 2026. The decision is due Oct 9. Here is what happens, screen by screen, in the working solution.
Priya's assessments list shows 14 vendors with recent activity, 5 of them needing her. Velunda Trial Cloud is Tier 1, in analysis: inherent Critical 88, residual High 64, 9 of 10 documents in and 1 missing, decision due Oct 9 — two days away.
“Showing 14 of 14 with recent activity · 472 more vendors in monitoring, all quiet”
The agents have read 611 of 627 answers from SIG Core 2026 and 112 SOC 2 pages, and mapped 640 answers and tests to the control framework. The security radar plots ten domains: blue is what the vendor says, green what the independent evidence shows, the dashed ring is the Tier-1 bar of 75. Encryption & keys reads “98 said · 52 shown”.
“The questionnaire says every backup is encrypted — the auditor found backups that were not”
SIG G.1.2 says all client data at rest, including backups in both hosting regions, is encrypted with AES-256. The SOC 2 test of CC6.7 found 2 of 10 sampled backup sets from the secondary region without encryption at rest before September 4, 2025. Management says earlier backups were re-encrypted by November 2025, with no evidence to the auditor — and the pen test still finds TLS 1.0 and 1.1 accepted on the SFTP gateway.
The SOC report reader quotes exceptions word for word and never treats a management response as evidence.
Questionnaire answer H.4.2 says MFA is enforced for 100% of privileged accounts. The SOC 2 test of CC6.1, on page 48, found 3 of 25 sampled privileged accounts without it. The finding asks for an identity-provider MFA policy export dated after February 2026, covering every privileged account.
“A contradiction needs both passages.”
The compliance statement says the audit trail is always on and cannot be disabled — but no validation summary or Part 11 assessment was supplied, and the SOC 2 does not test audit-trail controls. Privacy is not in the SOC 2 scope either, though patient data is processed. Both are listed as claims no independent test covers.
“Ask for: The vendor validation summary and Part 11 / Annex 11 assessment for the current release.”
Velunda's auditor assumed Northwind runs 7 complementary user entity controls. Five are in place. Two need action: the access review for this system runs once a year, not quarterly — Dana Okafor's — and the audit-trail review runs in 9 of 14 studies — Dr. Maya Chen's.
Inherent risk is Critical 88: protected health information in US patient diaries, GxP trial data supporting submissions, 14 live studies and 9–12 months to replace. Vendor controls bring the base to 34; seven findings add 30 — MFA +9, the open pen-test highs +8, backup encryption +4, no bridge letter +3, and +2 each for incident notice, validation and privacy.
Scores are explained, never bare — every point has its reason.
One request per finding, each with its due date and the passage it relates to — from the MFA export within 14 days to the HIPAA risk-analysis summary within 30. Contract clauses for the renewal come from the approved library, such as a 24-hour initial incident notice.
The writer sends nothing to a vendor without the analyst.
The recommended decision is “Approve with conditions”: 7 conditions, tracked to closure. Full reassessment Oct 2027 for a Tier-1 vendor, every 12 months, and a triggered check on Dec 15, 2026 for the pen-test retest letter. Residual is High, so Omar Haddad co-signs after her.
Priya signs, and Omar Haddad, Head of IT Risk & Compliance, co-signs for the High residual. The requests go to Marta Lindqvist, Velunda's CISO, and the clauses to Sam Patel in procurement. The reassessment is booked for Oct 2027, with the triggered check on Dec 15.
“Approved with conditions — co-signed by Omar Haddad, vendor and procurement told”
The same renewal, seen by the four people who carry it — what their review looked like, and what it looks like now.
Six agents read the questionnaire, SOC 2 and pen test, find contradictions and rate the risk; the third-party risk analyst decides.
Files each document a vendor sends — questionnaire, SOC 2, bridge letter, pen-test summary, certificate, policy, BAA — into the right assessment and flags what is missing.
Reads SIG Core, SIG Lite and CAIQ answers with their comments, keeping each answer's reference and cell. Blank or “N/A” answers count as unanswered unless a reason is given.
Reads SOC 2 reports in the order reviewers use — opinion, scope and criteria, carve-outs, controls on our side, Section 4 exceptions and management responses — and also pen-test summaries and policies.
Maps answers and tests to the Northwind Control Framework and finds contradictions, missing evidence, stale periods, missing criteria and carved-out fourth parties — reusing reports already on file.
Scores inherent risk from the tiering form and residual risk from controls and findings, with the reason for every point and the score if the conditions are met.
Drafts the remediation request to the vendor and contract clauses for procurement from the findings, and books reassessments by tier.
Decides; high risk signed twice. The agents propose; a named person decides.
Ask in plain words — every answer points to the page it came from.
Where do Velunda's answers and evidence disagree?
Two answers are contradicted. Encryption: SIG G.1.2 says every backup is AES-256, but the auditor found 2 of 10 backup sets unencrypted before September 2025, and the pen test still sees TLS 1.0 on file transfer. Access: MFA “100%” against 3 of 25 admin accounts without it.
Why is Velunda rated High?
Velunda is Critical inherent (88) — patient data for 14 studies, GxP trial data, 9–12 months to replace. Its controls bring the base to 34; seven findings add 30. The biggest driver: the auditor found 3 of 25 admin accounts without MFA while the questionnaire says 100%. With the conditions met it drops to Moderate (34).
What do we have to run on our side for Velunda?
Velunda's auditor assumed we run 7 controls. Five are in place. Two need action: quarterly access review (yearly today — Dana Okafor) and audit-trail review running in 9 of 14 studies (Dr. Maya Chen).
Which pen-test findings are open?
Velunda has 2 high findings open from the July test: object-level access on the patient-diary API and legacy TLS on file transfer. The retest is booked for November — after the Nov 15 renewal — so the decision carries a retest-letter condition by Dec 15.
13 screens from the working solution, on its sample data. Pick one to see it large.
The rules the agents apply, who decides and how often vendors are reassessed are settings. Changes apply to open assessments and are versioned.
| Setting | Default | Choose from |
|---|---|---|
| Patient or health data | Tier 1 | Tier 1 · Tier 2 |
| Ask for a bridge letter when a SOC 2 period ended more than | 3 months | 3 months · 6 months · 9 months |
| High pen-test findings fixed and retested within | 30 days | 30 days · 45 days · 60 days |
| Accept ISO 27001 in place of SOC 2 for Tier 2 and 3 | On | When the certificate scope names the service we buy |
| Reuse fourth-party reports already on file | On | A carved-out host's report is reused across every vendor that runs on it |
| Flag questionnaire answers the evidence contradicts | Always on for Tier 1 | Always on for Tier 1 |
| Tier 1 full reassessment | Every 12 months | Every 12 months · Every 18 months · Every 6 months |
| Residual High or Critical — co-signs after the analyst | Omar Haddad | Omar Haddad · Priya Raman |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample vendor data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, including the about-20-hour by-hand review (a 600-question questionnaire plus an 80–120-page audit report per vendor). Northwind Bio, its vendors, and the people named on this page are fictional — characters and sample data in the working solution.
Software that takes a supplier from its evidence pack — security questionnaire, SOC 2 report, pen test, policies and agreements — to a rated, signed decision. Vendor Security Assessment adds six agents that read the whole pack, score ten security domains from each source, flag every answer the independent evidence contradicts and explain residual risk, for the third-party risk analyst to decide and sign.
The SOC report reader works in the order reviewers use: opinion, scope and criteria, carve-outs, complementary user entity controls, Section 4 exceptions and management responses. It quotes each exception word for word, never treats a management response as evidence, and reuses a carved-out host's report already on file instead of asking for it again.
The control mapper and contradiction finder scores each domain from the questionnaire and from the independent tests, and flags any answer a test contradicts — for example “MFA is enforced for 100% of privileged accounts” against a SOC 2 exception for 3 of 25. Both passages are shown side by side, each cited to its page. It also lists claims no independent test covers.
Yes. The questionnaire reader reads SIG Core, SIG Lite and CAIQ answers with their comments and keeps the reference and cell of every answer it uses. The framework mappings in Settings cover SIG Core 2026, SIG Lite 2026, CAIQ v4, ISO 27001:2022 Annex A, NIST CSF 2.0, NIS2 Art. 21 and the SOC 2 criteria.
The risk rater scores inherent risk from procurement's tiering form — data handled, GxP use, access, scale and replaceability — then a base after the vendor's controls, plus points for each open finding, each with its reason. It also shows the score if the conditions are met; on the sample vendor that is High 64 today and Moderate 34 with conditions.
Yes. The agents recommend; the third-party risk analyst decides and signs, and High or Critical residual is co-signed by the Head of IT Risk. Nothing is sent to a vendor without the analyst, and clauses use approved wording only.
Yes. Tiering rules, bridge-letter age, the pen-test fix window, ISO 27001 in place of SOC 2, reuse of fourth-party reports, the reassessment cadence by tier, the triggers that open a review early and who approves are all settings, versioned when they change.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your control framework, tiering rules, clause library and a sample of past vendor evidence packs — and it goes live once every quality gate has passed. We will walk you through it on your own vendors first.
Testing sized to each function's risk, every line linked to its source.
1-min demoAudit Trail ReviewEvery audit-trail period reviewed on schedule and signed, rows cited
1-min demoAI Use Case Risk ClassificationEvery new AI idea classified in minutes, each conclusion tied to its clause.
1-min demoWe'll run Vendor Security Assessment on the evidence pack from one of your own Tier-1 vendors.