Every generation of vendor assessment solved the last one's problem

It was never really about the answers. It was about having asked.

What it solved

Before the questionnaire there was no record that diligence had happened at all. Standardised instruments — the SIG, the CAIQ, later industry variants — gave procurement a gate, gave auditors an artifact, and gave two companies a shared vocabulary for a conversation that had previously been ad hoc.

Crucially, it is still the only instrument that can ask about things you cannot observe from the outside: retention periods, personnel screening, what happens to data after termination, whether anyone is training on your records.

The assumption underneath

That the vendor's answer was accurate when written, and would remain accurate until the next review.

The insight was that you could learn something true about a vendor without their cooperation.

What it solved

Staleness. Outside-in scanning — certificate hygiene, exposed services, patching cadence, botnet signals — produced a daily signal where previously there had been an annual document. It also made vendor risk legible to executives for the first time, because a letter grade travels in a way a 300-row spreadsheet does not.

The assumption underneath

That observable external hygiene is a reliable proxy for internal control quality.

SolarWinds, Log4Shell and MOVEit made one thing obvious: the question was no longer whether a vendor was well run, but how fast you could tell you were affected.

What it solved

Time to know. Breach telemetry, dark web monitoring, exploit intelligence mapped against your vendor list, and managed services that chase remediation on your behalf. The posture shifted from producing reports to running an operation — who is affected, what do we do today, who calls the vendor.

The assumption underneath

That the risk event is a compromise: something is exploited, breached or leaked, and there is an incident to respond to.

Twenty vendors on the register. Three companies actually holding the data.

What it solved

Depth. Regulatory pressure — DORA in financial services, NIS2 across critical sectors, sector rules elsewhere — forced the question of what sits underneath each direct vendor. Discovery platforms began identifying vendor dependencies without relying on the vendor to disclose them, and concentration analysis surfaced the case where a single fourth-party failure propagates across many suppliers at once.

The assumption underneath

That the dependency chain can be reconstructed from published documentation plus external observation.

Third-party risk was built to answer who did we give data to. The question now is what are they doing with it this week.

What is actually different

Three things, and it is worth separating them because they have different owners.

• Pace. In May 2026 Microsoft moved AI subprocessor notice to thirty days against a six-month standard, with the ability to disable that subprocessor running at least six months from notice. Reasonable commercially — and it means protection changed from automatic to something you have to actively use.
• Control surface. The decision that matters most is a tenant setting owned by a business administrator, not a clause. It can revert after a release.
• Distribution. Roughly half the consequence lands outside security: employment law in hiring tools, consent exposure in recording tools, change control in regulated workflows, evidence integrity in audit.

Show the diagram: where AI now sits› Read the twelve as text›

What the market solves, and what it doesn't

Every category in this lineage is now marketing an AI capability, and some of it is real. The honest read is that vendors cover discovery and evidence well, and cover configuration, contract mechanics and accountability not at all.

Show the diagram: what you can buy, what you own›

The detail behind each shift — what changed, how the market responds, where the gap is, and the mechanism to build — sits in the five shifts tab of the working view below.