Vendor Security Review Agent
Reads what the assurance report actually says
4 of 8 vendors need attention.
8 vendors checked. 4 flagged. The largest gap is 531 days.
Start with PayRail. high has the most flagged.
Whether an answer is true, or a certificate sufficient for your risk, needs a security reviewer; it is not in the data.
Why rows were flagged
- Critical or high tier without a SOC 2 report33%
- No pen test in the last 12 months33%
- Questionnaire not returned after 30 days33%
Value flagged by Tier
- high2
- critical1
- low1
Items to act on, worst first
| Item | Tier | Value | Days since pen test or sent | Why |
|---|---|---|---|---|
| PayRail | critical | 3 | 531 | Critical or high tier without a SOC 2 report, No pen test in the last 12 months, Questionnaire not returned after 30 days |
| MailWave | high | 2 | 0 | Critical or high tier without a SOC 2 report |
| DataBridge | high | 2 | 0 | No pen test in the last 12 months |
| OfficeCo | low | 1 | 171 | Questionnaire not returned after 30 days |
What to do this week
- Resolve PayRail first: it is the most urgent on the list.
- Fix the data or the status on every flagged row, then re-run.
- Re-run this check every time the list changes, before it reaches a decision.
Do
- Fix the highest-risk item first, then run the check again on fresh data.
Don't
- Don't act on one row alone: open the source record first.
How to improve
- Add more detail per row (owner, date, source) so the next report can trace each item.
- Add a second period of data so the next report can show whether things are improving.
Demo
Overview
Third-party security review has become a ritual. A vendor sends a completed questionnaire and an assurance report, somebody files them, and the vendor is approved. The documents are rarely read closely, because doing it properly means knowing what to look for in a hundred pages of language written to reassure.
What matters is almost never in the answers. It is in the scope statement — an assurance report covering a different product than the one you are buying is common and worth nothing to you. It is in the exceptions, which every report has and no summary mentions. It is in the period, because a report covering a year that ended fourteen months ago says nothing about the company today. It is in the subprocessors, the vendor's own supply chain that inherits your data, usually listed on a web page rather than committed in a contract.
And above all it is in the mismatch between what the questionnaire claims and what the report actually tested. That is the most useful check available and almost nobody performs it, because it means reading both documents against each other.
This agent does that reading and reports what it found, what it could not verify, and the specific questions to put back to the vendor. It approves nothing and scores nothing: a risk decision belongs to the person accountable for it.
Benefits
Reviews that actually review
Rather than filing documents and calling it diligence.
Specific questions to send back
Which is what moves a vendor, not a generic follow-up.
A defensible record
Of what was checked and what was accepted, with reasons.
What it does
Checks the scope first
A report covering a different product than the one you are buying is common, worth nothing, and stated in one paragraph nobody reads.
Finds the exceptions
Every report has them and no summary mentions them. An opinion with four exceptions is not a clean one.
Checks the period is current
A report that ended fourteen months ago describes a company that may no longer exist in that form.
Maps the subprocessors
Your data's onward journey. Usually a web page the vendor can change without telling you.
Tests claims against evidence
Where the questionnaire asserts something the report never tested. The most useful check there is, and the least performed.
Approves nothing
It produces findings and the questions to ask. Accepting a risk belongs to the person accountable for it.
What this changes
What this changes about your week
- It takes over
- Actually reading a vendor's questionnaire and assurance report against each other.
- Done today by
- Whoever files them, which is not the same as reading them.
- How often
- At onboarding and annually, on paper.
- Typical manual effort
- A hundred pages of assurance language written to reassure.
Why Cybersecurity in particular. What matters is never in the answers — it is in the scope paragraph, the exceptions the summary omits, the period that ended over a year ago, and the claims the report never tested.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Vendor Security Review Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Requirements
Integrations
No integrations required.
Before you start
- The vendor's completed questionnaire
- Their assurance report or certification, in a knowledge base
- What data and access the vendor will have
- Requires the All-Access plan or higher
Use cases
Onboarding a vendor
Before data reaches them, while you still have leverage.
Annual reassessment
Whether last year's assurance still describes this year's vendor.
Before a renewal
What has changed in their posture and their supply chain.
Answering your own customer's diligence
Knowing what your vendors would survive.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Does it approve or reject vendors?
No. It reports what the documents support and what they do not. Accepting a risk is a decision that belongs to whoever is accountable for it, with business context this cannot see.
Does it test the vendor's systems?
Never. It performs no scanning, probing or testing of any kind. It reads the documents you were given.
What if the vendor supplied nothing useful?
Then that is the finding, stated plainly. "No assurance evidence was provided" is more valuable than a review that treats marketing material as evidence.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent