Your Security Questionnaire Queue Has 34 SIGs Open and GRC Answered Six

It is Monday, 8:14 AM. Your VP Sales opens the deal desk tracker before the pipeline review. 34 security questionnaires open against Q4 opportunities. He sorts by days since receipt. The top row reads 41 days, a $420K enterprise deal in financial services with a 312-question SIG Lite sitting with the GRC analyst since August 22nd. The next three rows read 28, 24, and 19 days. Nine deals in the open queue have a buyer deadline inside the next ten business days.

He opens the SIG. 312 questions across SOC 2 scope, encryption, data residency, subprocessor list, incident response, and six custom pages the buyer's CISO added last cycle. The GRC analyst answered 48 questions and flagged 71 as "needs engineering." A Slack thread in #trust-and-security has been quiet since Wednesday. The AE pinged the GRC lead Thursday and got a Friday reply pointing at a Loopio library last refreshed in May.

Pull the last two quarters. 94 security questionnaires received. GRC shipped answers to 38. 22 deals pushed to the next quarter citing "security review in progress." Average turnaround lands at 23 business days against a buyer SLA of ten. On a $240K average ACV that is $4.4M to $5.3M of pipeline the forecast carries into a quarter the deal was supposed to close inside.

The 34-questionnaire math

Pull every opportunity in Salesforce stage three or later with a security questionnaire on the record. Log receipt date, buyer-named deadline, questions open, questions answered, questions flagged for engineering, and the last touch date in the GRC Slack. Count questionnaires past the buyer deadline. Count questionnaires with more than 40 percent of questions still flagged "needs engineering" after 14 days. Most Series B and C teams past the first ten enterprise logos find 60 to 75 percent of open questionnaires miss the buyer SLA, 30 to 45 percent carry a stale "needs engineering" flag older than 10 business days, and one in four deals slips a quarter on security review.

Walk one. The August financial services deal signed into procurement on August 15th. The buyer's CISO sent the SIG on August 22nd with a September 19th deadline. The GRC analyst opened the file August 25th and tagged 71 questions for engineering review. A platform engineer answered 11 of them on August 29th and rotated to an incident on August 30th. The remaining 60 sit in a Jira label nobody owns. The AE pushed the deal to Q4 on the September 24th forecast call.

The team that should own this knows it is broken. The GRC lead carries SOC 2 audit prep, a vendor risk program, and a quarterly policy refresh. The deputy answers questionnaires between audit tasks and spent 60 percent of September on the ISO 27001 kickoff. Engineering treats "needs engineering" tags as a Friday afternoon chore. The Loopio library holds 2,400 question-answer pairs. Six hundred are flagged stale and the last library refresh ran in May.

Why Vanta and Drata do not clear the queue

You bought Vanta or Drata at $42K to $86K a year for continuous control monitoring. You bought Loopio or Responsive at $38K to $72K a year for the question library. Vanta tracks your controls, maps evidence to SOC 2 and ISO 27001, and ships a trust center page. Drata runs the same shape with a tighter policy workflow. Neither reads the 312-question SIG the buyer sent on August 22nd and drafts the 312 answers against your current control state, your current subprocessor list, your current encryption posture, and your current data residency map.

Loopio stores the question-answer pairs. Loopio runs a project workspace for the questionnaire. Loopio suggests library matches on each incoming question. The suggestion fires on a keyword match against a library entry last refreshed in May. The GRC analyst reads the suggestion, decides whether it reflects the current SOC 2 report dated July, rewrites 60 percent of the answers, and flags the ones that need engineering. The library is a storage layer, not a function.

What a security response function is

A security response function has six parts. An intake step that reads the incoming SIG, CAIQ, or custom spreadsheet and classifies every question against your control taxonomy. A drafting step that pulls the current SOC 2 report, the current ISO statement of applicability, the current subprocessor list, the current DPA, the current penetration test summary, and the current trust center copy and writes a first-pass answer with citations. A routing step that sends the 20 to 60 questions genuinely needing engineering into the right Jira component with a 72-hour SLA. A review step that walks the GRC analyst through the drafted file, highlights the five answers that drift from the current control state, and flags the one or two the GC should read. A delivery step that ships the file in the buyer's format back through the AE on a timestamp the forecast call can carry. A refresh step that rewrites the library entry every time an audit report ships or a subprocessor changes.

Not one of those parts runs off Vanta's control monitor. Not one runs off Loopio's keyword suggestion. Not one runs off the two GRC humans batching questionnaires between audit tasks. The function lives in the gap between the GRC team that owns the control, the engineering team that owns the implementation detail, the legal team that owns the DPA, and the AE who owns the buyer deadline.

What a fractional AI security response function does

Hand the SOC 2 report, the ISO 27001 SoA, the subprocessor registry, the DPA template, the penetration test summary, the Vanta control feed, the Loopio library, the engineering architecture docs, and the last 200 answered questionnaires to a fractional AI agent. The agent does the work two GRC analysts and three rotating platform engineers would do together. The cadence is per-questionnaire on intake, per-24-hours on drafting, per-72-hours on engineering routing, per-release on library refresh.

Every incoming questionnaire classified in 90 minutes. The August SIG lands at 9:00 AM. By 10:30 the agent has mapped 312 questions against the control taxonomy, drafted 240 answers with citations into the current SOC 2 report and subprocessor list, routed 48 to engineering with a 72-hour SLA, and paged the GRC analyst with the five answers that drift from the current control state.

Every "needs engineering" question routed with context. The 48 engineering questions land in the right Jira component with the current architecture doc, the related library entry, and the specific control reference the buyer cited. The platform engineer answers inside the 72-hour SLA because the question arrives with context, not as a Slack mention.

Every library entry refreshed on audit ship. The July SOC 2 report commits to the trust vault. By end of day the agent has rewritten the 180 library entries that cite SOC 2 scope, encryption, or incident response language. The next SIG draws against the current report, not the May one.

Every file shipped inside the buyer SLA. The AE opens the forecast call Monday with the SIG shipped Friday, signed off by GRC and legal, inside the ten-day SLA the buyer named. Read the reporting case for the same operating shape against a different function.

The unit economics of a stuck queue

A Series B company at $34M ARR running 94 enterprise questionnaires a year on a 23-day turnaround is burning three things. The GRC lead, a deputy, and three platform engineers spend a combined 22 to 34 hours a week on questionnaire drafting, Jira chasing, and library hygiene against a fully loaded hour of $160 to $280. That is $14K to $38K a month of GRC and engineering time on work a live agent clears. The GRC team recovers two full days a week for audit and vendor risk inside the first sprint.

The revenue line is the second one. Moving average turnaround from 23 to seven business days pulls one forecast cycle forward on 22 of 94 opportunities. On a $240K ACV that is $2.4M to $3.8M of pipeline the fiscal year recognizes against a slipping Q4 forecast. The slippage rate on security review drops from 24 percent to 7 percent on the enterprise cohort.

The trust line is the third. Buyers reading an answer that cites a July SOC 2 report, a current subprocessor list, and a specific control reference close faster than buyers reading an answer that reads "see attached." Three of the top four CISOs on the current pipeline have asked for an answer-by-answer walkthrough before signing. The current library does not stand up to that walkthrough. The current audit output does.

A 14-day sprint to stand up the agent runs in the low to mid five figures. Ongoing cost lands at $3K to $6K a month on API spend and tooling plus a fractional GRC operator at $5K to $8K a month who owns the Monday review and the engineering escalation. Intake and drafting run in week one. Engineering routing and library refresh run in week two. The first full SIG ships inside the buyer SLA before the sprint closes.

What changes after the sprint

Picture the same Monday, 8:14 AM moment, thirty days after the sprint ships. Your VP Sales opens the deal desk tracker. 34 open questionnaires. The August financial services SIG now reads shipped on day 11, inside the buyer SLA, signed off by GRC on day 9 and legal on day 10. The forecast carries the $420K deal in Q4, not pushed.

By Thursday the GRC lead reads a trust response digest that names the three questionnaires at risk of missing SLA, the four engineering routes still open, and a library refresh queue tied to the September subprocessor update. The deputy spends Thursday on ISO 27001 scope, not on a 312-row spreadsheet.

If your deal desk tracker currently reads 34 open SIGs with 22 deals slipping a quarter on security review, the version where every questionnaire ships inside ten business days with citations the CISO reads line by line is fourteen days away. Security questionnaires are a function. You can hire a second GRC analyst against it, you can retain a fractional response operator, or you can scope a sprint and have it running this month. The work is the same. The forecast is not.