Security questionnaire automation is software in which an AI model reads a company's security policies and evidence, and drafts the answers to a customer's security questionnaire. A person then checks each answer before it is sent.
A security questionnaire is a long list of questions that a customer sends to a supplier before it signs a contract. Typical questions are: "Do you encrypt customer data when it is stored?", "How quickly do you remove access when an employee leaves?" and "Where are your servers?" A large bank or hospital may send 200 or 300 such questions. The customer uses the answers in its third-party risk management, its record of how safe each supplier is. A software company that sells to 50 customers may receive 50 different questionnaires a year, with mostly the same questions in different words.
Answering by hand is slow. A security engineer finds the right policy, copies a paragraph, adjusts it and attaches proof. One questionnaire can take a week of an engineer's time.
Take, for example, an expense-management software company in Gurugram. A large insurance company sends it a questionnaire with 240 questions. The company uploads the file. The AI model reads each question and searches the company's library: its security policies, its last ISO 27001 audit report, and the live control results from compliance automation. The library clearly answers 214 questions. The model drafts an answer for each of them, and shows the document it used. It marks the other 26 questions as uncertain. One of them asks about a backup data centre that the company has never described. The security lead reads all the drafts, corrects 11 of them, and writes the 26 uncertain answers herself. The questionnaire goes back in two days instead of a week.
This is an example of human in the loop: the model drafts and a person approves. The person matters here. A wrong answer is a promise to the customer, and it may end up in the contract. So the software must show where each answer came from, and it must never invent a control that the company does not have.
Approved answers are saved in the library, so the next questionnaire starts from them. They are also linked to the controls in the GRC platform, so an answer is flagged when the control behind it changes.
Sales teams use similar software for a different document. RFP software drafts answers to a buyer's request for proposal, which asks about price, features and delivery rather than security.