Security questionnaires remain a standard part of B2B procurement, especially when a supplier will handle data, connect to internal systems or support critical business processes. A new SecurityWeek commentary highlights a long-running problem: many companies do not fully trust self-assessed security answers, yet the questionnaires still influence purchasing decisions.

For European businesses, this is more than an administrative frustration. It affects how companies assess suppliers, document cybersecurity checks and manage third-party risk in an environment shaped by GDPR, contractual security obligations and, for some organisations, stricter governance under frameworks such as NIS2.

What happened

The source article argues that the security questionnaire has become a default gate in B2B sales and procurement even though both sides often understand its limits. Suppliers may complete lengthy forms describing policies and controls, while buyers may use those responses as part of a trust decision without independent verification of every claim.

The core point is not that questionnaires are useless, but that they are frequently treated as a stronger signal of security maturity than they really are. The article suggests there is growing interest in more reliable, evidence-based ways for companies to demonstrate their security posture to customers and partners.

Why it matters for European businesses

European SMEs and larger organisations increasingly depend on software vendors, cloud providers, agencies, payment services and automation platforms. Each new supplier can introduce operational, data protection and cybersecurity risk.

When vendor reviews rely mainly on spreadsheet-style questionnaires, several business problems can follow:

• Procurement delays: sales cycles can slow down when customers send long security forms that require input from IT, legal and management teams.
• Weak assurance: a completed form does not necessarily prove that security controls are implemented effectively in practice.
• Inconsistent assessments: different customers ask similar questions in different formats, creating duplication for suppliers and uneven review standards for buyers.
• Compliance pressure: where businesses process personal data or rely on important digital suppliers, poor vendor due diligence can create legal, contractual and operational risk.

This is particularly relevant for European companies that outsource web hosting, e-commerce functions, analytics, CRM, marketing automation or AI services. In many cases, a supplier relationship involves access to customer data, business systems or critical online operations.

Who may be affected

• SMEs selling into enterprise markets: smaller vendors often face extensive security questionnaires that consume time and slow revenue.
• IT and security teams: internal teams may need to review supplier controls but lack enough evidence beyond written responses.
• Founders and operations leaders: supplier onboarding delays can affect growth, partnerships and implementation timelines.
• Marketing and digital teams: agencies and martech providers increasingly face customer scrutiny over data handling, platform security and subcontractors.
• Regulated or risk-sensitive businesses: organisations in sectors with stronger oversight may need more robust third-party assurance than a self-attested form alone.

What companies should consider

European businesses do not need to abandon questionnaires entirely, but they should be careful not to treat them as complete proof of security. Practical steps may include:

• Use questionnaires as a starting point, not the final decision: match the depth of review to the sensitivity of the service, data access and business criticality.
• Ask for supporting evidence where appropriate: this may include security policies, independent audit reports, certifications, penetration testing summaries or incident response documentation, where available.
• Standardise internal vendor reviews: create a risk-based process so low-risk suppliers are not assessed in the same way as providers handling sensitive data or core infrastructure.
• Review contracts alongside security claims: ensure data processing terms, breach notification duties, access controls and subcontractor arrangements align with business requirements.
• Reduce duplication for your own business: if you are a supplier, prepare a consistent security information package so sales and customer success teams can respond faster to common due-diligence requests.

The broader message is practical: trust between companies increasingly needs stronger evidence than self-completed forms alone. For European businesses buying or selling digital services, improving third-party security assurance can help shorten sales cycles, reduce risk and support more defensible procurement decisions.