Should You Send Every Critical Vendor a Vulnerability Questionnaire?

I recently asked a simple question on LinkedIn: should TPRM programs send a PHP2Shell questionnaire to all of their critical vendors? At the time of writing, of the 36 people who picked an answer, 22 said yes and 12 said no. That is a clear majority, but not a consensus, and the split is worth taking seriously. Both sides are right about something.

The pattern is familiar. A serious vulnerability gets disclosed, it shows up in the news, and within a day the TPRM team is drafting a short questionnaire to send to every critical vendor: Are you affected? Have you patched? Is there any sign our data was involved?

The case for sending it

The first argument is simple: assurance is valuable. A direct answer from a vendor, even a short one, tells you something you did not know an hour earlier. It confirms the vendor is aware of the issue, it starts a conversation if they are affected, and it creates a dated record of what they told you and when.

The second argument is about expectations. When a vulnerability makes headlines, someone will ask: were any of our vendors affected? It might be the board, an auditor, a regulator, or one of your own customers sending you their questionnaire. They may not expect this exact activity, but they do expect you to have done something and to be able to show it. "We reached out to our critical vendors and here are their responses" is an answer. "We assumed they were fine" is not.

The case against

The first problem is logistics. Do you know which of your critical vendors run the affected technology? Often you don't, so the questionnaire goes to everyone. Then the contact details are out of date, the responses trickle in over two or three weeks, and by the time the last one arrives the vulnerability has either been patched everywhere or already been exploited. Meanwhile every vendor is getting the same email from hundreds of customers at once, which is exactly when their security team is busiest.

The second problem is the one every questionnaire has: who will answer truthfully? A vendor that is affected and has not patched has every reason to say "we are not impacted" or "we have applied mitigations." You cannot verify the answer. In the worst case, the questionnaire produces a comforting record of claims that turn out to be wrong, and that record is what you hand to the auditor.

The real work happens before the vulnerability

This is where the no voters have a point. The incident-time questionnaire is really a test of the vendor selection you already made. If your critical vendors have mature vulnerability management, they will patch quickly, and the good ones will tell you before you ask. If they don't, a questionnaire will not fix that.

So the responsibility shifts upstream, to picking vendors who will do a good job on vulnerabilities and remediation in the first place. That means looking at it during due diligence, not after the headline:

• Does their SOC 2 actually test vulnerability management and change management, and were there exceptions?
• Do they run regular penetration tests and fix what they find?
• Do they publish security advisories or keep a status page for incidents like this?
• Does the contract require them to notify you of critical vulnerabilities affecting your data within a set number of days?

A vendor that checks those boxes is one you can mostly trust to handle the next PHP2Shell without being asked. A vendor that doesn't is one where even a "yes, we patched" should not make you feel much better.

A middle path

The answer for most programs is yes, but smaller and more targeted than a blanket send:

• Check first. Many vendors post a public statement within days. Read those before asking.
• Ask only the critical vendors where exposure is plausible, based on what you know about their stack.
• Keep it to three questions: Are you affected? If so, when was it fixed or mitigated? Is there any indication our data was involved?
• Record the answers and the non-answers. A critical vendor that stays silent is telling you something.

That gives the board and the auditor the record they expect, without pretending a mass email is a control.

The better question to ask after every big vulnerability is not whether to send the questionnaire. It is this: for which vendors did we have to ask, and what does that say about how we chose them?