Contents
Your company works with an average of 286 outside vendors today. Each one has access to your data, your systems, or your customers’ data. And 77% of companies that suffered a breach in the last three years confirm it started with one of those vendors, not their own network. The problem isn’t that companies don’t know this: 94% openly admit they would assess more vendors if they had the time, technology, or headcount to do it. They know, and they still accept the risk, because manually reviewing hundreds of security questionnaires is no longer humanly possible at the pace the business demands.
The Scale Problem: One More Vendor, One More Questionnaire
In 2025, 56% of companies work with more than 100 vendors, up 6% from last year. The average has climbed from 237 to 286 outside vendors per company in just twelve months. Risk teams have grown trying to keep pace — from 5.6 to 8.5 people on average — but each third-party risk professional is still responsible for assessing 33.6 vendors on their own, not counting the ones onboarded mid-year. Adding one more hire now costs $109,000 on average, and 80% of companies plan to keep hiring this year, even knowing the real problem isn’t headcount, it’s process (Whistic, 2025 TPRM Impact Report, survey of 525 security and risk leaders).
The Cost of Not Getting to Everyone
70% of surveyed companies experienced a breach in the last three years — up from 55% reporting the same in 2023 — and in 77% of those cases the breach originated with a vendor or supply-chain third party, not an internal failure. The average cost of a single breach has already reached $4.88 million globally, $400,000 more than the year before (IBM, Cost of a Data Breach Report 2024, cited in the same Whistic report). This isn’t just bad luck: 97% of companies admit they would run deeper assessments with better processes or technology, and 94% would directly assess more vendors than they currently audit. In other words: most companies already know, by name, which vendors they aren’t reviewing closely enough.
The Real Bottleneck: The Security Questionnaire
The reason isn’t laziness, it’s arithmetic. The average vendor now responds to 37.3 security assessment requests a month (up from 29.5 last year) and spends 179 hours a month answering them — the equivalent of one full-time employee doing nothing but filling out questionnaires. On the buyer side, 58% of teams spend more than 30 hours a week assessing vendors (a 37.4-hour average, up 14 hours from last year), and a vendor’s complete response takes 12 days on average: 87% of companies wait more than 4 days, and 56% wait more than a week. To make it worse, 84% of initial assessments require a follow-up round because the first response comes back incomplete.
On top of that sits reactive work: the average company handles 7 security incidents a year — like last year’s CrowdStrike outage — that force a reopening of the affected vendors’ assessments, at 14.8 extra hours per incident. That’s more than 100 hours a year just on emergency reassessments, before touching the rest of the backlog.
Where AI Actually Fits (and Where It Still Doesn’t)
60% of risk leaders now say artificial intelligence is the single most important trend shaping the future of this discipline, up from 51% last year, and 57% already use it somewhere in the assessment process (another 40% are testing it or will within 12 months). But only 4% have completed the move to a truly AI-first model: most companies (49%) are still questionnaire-based, with modernization plans they haven’t executed yet.
To be blunt: AI here isn’t about “sounding more secure” on a call, the way it is in the voice-cloning fraud we’ve already covered. It’s useful for three very specific jobs still done by hand today:
- Summarizing reports nobody reads in full. 82% of companies request a SOC 2 report as part of their assessment, but it runs hundreds of pages — AI condenses it into a 5-page summary tied to the specific controls you’re checking, not a generic overview.
- Flagging control gaps automatically, instead of a person combing through document after document looking for what’s missing.
- Monitoring continuously, instead of a once-a-year snapshot: when an incident like CrowdStrike’s hits, AI can cross-check your entire vendor inventory in minutes for who’s exposed, instead of reviewing vendors one by one.
None of this replaces the access governance for your own AI agents connected to third-party tools via MCP or the least-privilege permissions any vendor with access to your systems should have — it’s the layer that tells you, before you grant that access, whether the vendor is trustworthy in the first place. It also doesn’t replace a Zero Trust architecture inside your own walls: the two work together — one assesses who gets in, the other limits what they can do once they’re in.
What to Do This Week
- Count how many vendors you actually have (not just the ones you remember): most companies underestimate the real number until they run the inventory.
- Ask your risk team how many assessments are overdue right now, not how many they complete per year: that’s the number that matters.
- Identify which vendors haven’t been reassessed in over 12 months: that’s your most likely invisible risk.
- Before buying an “AI vendor risk” tool, ask exactly what it does: summarizing documentation, flagging gaps, and continuous monitoring are three different jobs, and few tools do all three well.
- Require your critical vendors to maintain a ready-made documentation channel (a trust center): 76% of vendors already offer one, and it turns weeks of waiting into minutes.
- Add one question every questionnaire skips: which country actually processes the data once the vendor has access, not just where it is stored — see our breakdown of AI data sovereignty for business.
How We Help
At Optima Quantum, we don’t sell “assess your vendors with AI” as a black box: we start with a cybersecurity audit that tells you how many of your current vendors actually have real access to your systems and which ones haven’t been reviewed in the past year, then we design the monitoring process with you — with or without AI, based on what you actually need — as part of our cybersecurity services. If you manage vendors, integrations, or third-party access and don’t know how many of them you’re not getting to, contact us and we’ll review it together.
Frequently Asked Questions
How many vendors does the average company have? 286 in 2025, up from 237 in 2024, according to Whistic’s survey of 525 risk leaders. 56% of companies already work with more than 100.
Does vendor risk really cause that many breaches? Yes: 77% of companies that suffered a breach in the last three years confirm it originated with a vendor or third party, not their own internal network.
Is an annual security questionnaire enough? No. The average vendor takes 12 days to respond completely, and 84% of initial responses come back incomplete. One snapshot a year doesn’t reflect what changes in the other 11 months.
Does AI already solve this as a standard practice? Not yet. Only 4% of companies have completed the move to an AI-first assessment model; 57% use it for part of the process. It’s a technology still being adopted, not one already installed across most companies.
Get our new articles by email
One email per article. Unsubscribe anytime.