Third-party risk management was built on slow-world assumptions.
- Vendor environments are stable enough to evaluate once and revisit on a cycle.
- Questionnaire captured at a single point in time tells you what you need to know until the next renewal window.
- Risk reviews and risk decisions can happen at roughly the same pace.
These assumptions are no longer defensible.
Vulnerabilities surface daily. Vendor environments change between every assessment cycle. Incidents do not wait for an analyst to schedule a follow-up.
A few numbers make the gap concrete:
- Third parties are now involved in 30% of breaches, according to Verizon's 2025 Data Breach Investigation Report.
- FIRST projects more than 59,000 CVEs this year, and the pace keeps rising.
- ISC2 reports that 69% of organizations are using or evaluating AI in security, while 88% report material consequences from skills gaps.
The pressure on TPRM teams is increasing. The model they are working inside has not changed.
The questionnaire is not the problem
It is tempting to blame the questionnaire itself, but the questionnaire is just an artifact. The real friction sits around it.
Most teams do not actually struggle to send assessments. They struggle with the gravitational pull of the work that surrounds them.
The same questions get re-asked across vendors and across time. The same evidence gets re-collected from teams who already provided it. The same decisions get re-explained because the context that supported them was never preserved in a usable form.
The cost of this is not theoretical. It is the work analysts do every day instead of evaluating risk.
Across hundreds of customer relationships, the same security teams answer slightly different versions of the same questions. Across hundreds of vendor relationships, the same risk teams chase down the same documentation they collected six months ago. The information exists. It has just never been organized into something that can be reused.
That is what slows programs down. Not the absence of data, but the absence of structure.
Repetition without progress
Over time, this pattern simply does not scale.
The same answers are rewritten. The same documents are uploaded. The same decisions are reconstructed from memory or inference. Effort accumulates. Insight does not.
Meanwhile, the demands on the function keep expanding. New regulations, new AI vendors, new fourth-party concentration risks, new disclosure obligations. Each of these arrives faster than the workflow that is supposed to absorb it.
The constraint is not awareness. Risk teams know exactly what they should be tracking. The constraint is capacity, and most of that capacity is being spent on work that does not move a risk decision forward.
From reviewing risk to operating on it
The shift happening beneath the surface of the category is from a review model to an operating model.
- A review model produces a verdict at a point in time.
- An operating model maintains a position over time.
The difference is not subtle.
In an operating model, programs respond to change as it happens rather than batching it for the next assessment cycle. Decisions are made against current conditions, not against the snapshot that existed when the relationship started. Defensibility is continuous, because the underlying record is continuous.
This is not a process change. It is an architecture change.
A static response captured once and filed away cannot be operated on later without rebuilding the context around it. The information is technically present, but it is inert. Every new signal forces teams to start over, and at scale, "starting over" is what breaks the program.
Faster is necessary. But it is not enough.
Most TPRM programs are already trying to make questionnaires faster. AI is helping security teams respond to incoming assessments in hours instead of weeks. Pre-built profiles let vendors answer once and share many times. The mechanics of the questionnaire have improved meaningfully in the last two years, and they should keep improving.
That progress matters. It also has a ceiling.
Faster questionnaires speed up an exchange. They do not, by themselves, change what the exchange produces. If the output is still a static response that lives in a folder somewhere, the program has accelerated the same loop, not exited it.
What gets a program out of the loop is making the data behind the questionnaire reusable. Call it trust intelligence. The properties matter.
- It is structured rather than narrative, so machines and humans can both work with it.
- It is source-backed, so every claim links to underlying evidence.
- It is persistent beyond a single assessment, so it accrues value rather than expiring on submission.
- It is able to evolve as conditions change, so the record reflects the present rather than the past.
Trust, treated this way, stops being a one-time exchange. It becomes an asset. Something that can be reused across customers, extended as new questions arise, and updated continuously without restarting the relationship.
This is the shift the category is moving toward, and it is the shift Whistic is actively building for.
Faster questionnaires are how programs get back hours. Reusable trust intelligence is how they get back the model.
What actually changes
When trust data becomes reusable, the day-to-day shifts in concrete ways.
- Assessments start with context instead of a blank slate.
- Follow-up focuses on what has changed instead of what is already known.
- Evidence stays connected to the decisions it supported.
- New signals are evaluated against existing understanding rather than triggering a fresh investigation.
The work moves away from collecting information and toward using it. That distinction is the difference between a TPRM program that breaks under volume and one that absorbs it.
Where this is going
The direction is showing up well beyond product roadmaps. NIST's AI Risk Management Framework emphasizes traceability, transparency, and continuous evaluation. ISACA has called out the limits of traditional third-party risk models in dynamic environments. The next wave of regulatory expectations, from DORA to NIS2 to evolving SEC disclosure rules, assumes a posture that point-in-time assessments cannot demonstrate.
The expectation is consistent. Static inputs are not sufficient to govern continuous risk.
The next standard for TPRM
The future of vendor risk management is not about sending better questionnaires. It is about building a system that captures trust data once, keeps it current, makes it reusable across decisions, and connects it directly to the actions teams need to take.
The point is not to prove that a vendor was reviewed. It is to reduce risk, demonstrably, over time.
Stop assessing. Start operating.
Questionnaires will not disappear overnight. They will, however, stop being the center of the model. The organizations that adapt will be the ones that stop treating assessments as isolated events and start treating trust information as something continuous, structured, and usable across every decision the program needs to make.
In a world where risk is always changing, the system for managing it has to change with it.
The best questionnaire is the one already half-answered before it arrives.