Choosing security questionnaire software: a UK buyer's guide

Search results for "vendor security questionnaire tools" mix two different markets. Sending-side tools help a company issue questionnaires to its suppliers and score the replies (third-party risk management). Answering-side tools help a supplier, or the consultancy acting for them, respond. This guide is about answering-side software.

Answering tools broadly work in one of three ways:

• Answer library retrieval — the tool finds the closest past answer and suggests it. Fast, but only as current as the library.
• AI generation from documents — a language model drafts answers from policies you upload. Fluent, but it describes what the policy says, not what your systems actually do.
• Derived from live evidence — the tool reads configuration and vulnerability data from your systems and answers from that. More set-up, but the answer reflects reality on the day.

This is the most important question and the one most often skipped. If an AI model decides whether you meet a control, the same question can get different answers on different days, and nobody can explain why. For controls with a hard rule — Cyber Essentials v3.3's 14-day window for high and critical updates, or MFA on every cloud service — the verdict should come from deterministic code you could, in principle, check by hand. Use AI for the narrative, not the verdict.

A policy uploaded last quarter says nothing about whether MFA is enforced today. Ask whether the tool enforces a freshness window on evidence, and what it does when evidence is stale: a trustworthy tool refuses to answer rather than guessing from old data.

Every answer you send is a representation to a buyer. Look for a review queue that routes uncertain answers to a person, lets them edit before approving, and records who approved what and when. Without that record you cannot defend an answer later.

A questionnaire tool sees sensitive information about your estate, so apply to it the scrutiny your buyers apply to you. Ask what leaves your network, whether secrets and personal data are removed before upload, whether you can inspect the collection code, where data is hosted (UK or EU hosting often matters to UK public-sector and regulated buyers), who the subprocessors are, and how tenants are isolated from each other.

Buyers want their own spreadsheet back, completed, in their layout. Some tools export a PDF or push buyers to a portal instead, which creates friction. Also ask whether the buyer can verify that what they received is what you issued — for example through a content hash they can check independently.

Check the frameworks are the ones your buyers ask about. For UK suppliers that usually means ISO/IEC 27001:2022 and Cyber Essentials; US-centric tools may lead with SOC 2. If you are a consultancy, check the tool supports many client workspaces under one login, with real isolation between them rather than folders in one account.

Pricing varies widely: per seat, per questionnaire, or annual platform contracts, often in US dollars. Model it on your real volume, and ask what happens at the limit. A hard cap you choose to raise is easier to budget for than overage charges discovered on an invoice.

1. Who or what decides whether a control passes — code, an AI model, or a person?
2. Where does each answer's evidence come from, and how old is it allowed to be?
3. What leaves our network, and can we read the code that collects it?
4. Where is our data hosted, and who are your subprocessors?
5. How is one customer's data isolated from another's?
6. Can we return answers in the buyer's own spreadsheet, formatting intact?
7. Is there an audit trail of who approved each answer?
8. How is your headline time saving measured, and on whose data?
9. What happens at our plan limit — a hard stop or an overage bill?

Securevoo is answering-side software built for UK compliance consultancies. Verdicts are computed by deterministic code from live, freshness-checked evidence collected by an open-source collector; the AI drafts the narrative; uncertain answers go to an audit-trailed human review queue; and buyers get their own workbook back or a proof pack they can verify at a public link. It is UK-hosted and priced in pounds on monthly invoices, hard-capped at your allowance.

It is the wrong choice if you need an ISMS builder, a public trust portal, or SOC 2 and other US frameworks as your main focus. See Securevoo for consultancies and pricing.