Six weeks of email, or two days: the administrative cost of manual vendor chasing

1. Introduction

The standard enterprise onboarding loop involves a lot of waiting. While cybersecurity professionals love analyzing cryptography and network topologies, the reality of vendor risk management is far more mundane: it is a coordination crisis. Security professionals spend the majority of their operational hours chasing PDFs, requesting fresh SOC 2 reports, and updating trackers.

This report isolates the exact stages where friction arises, utilizing anonymized data from over 41,000 vendor reviews processed. What we found is that automated evidence vaulting can contract the review loop down to just two operational days.

The numbers below are not a projection. They are the measured difference between a review that waits on a human to remember, and one that waits on nothing.

2. The operational bottleneck

Why does a review take 31 days on average? The answer is simple: email turnaround latency. When a business unit files a procurement request, compliance rules trigger a standard security assessment questionnaire. The vendor contacts their security team, who retrieves the PDF packet from a different internal storage server, mails it back, and the cycle continues.

“Chasing is a design flaw. When you send a standard form asking for a document that is already publicly declared on a vendor’s corporate trust portal, you’re not auditing—you’re just creating email threads.”

Each hop in that chain costs between one and four business days, and none of them are analysis. Strip the hops out and the analysis itself takes an afternoon.

3. Evidence vs promises

Continuous security monitoring relies on artifacts, not assertions. Questionnaires generate promises; registries yield evidence. A modern automated evidence extraction algorithm should dynamically:

• Continuously discover fresh SOC 2 and ISO certificates from global security endpoints.
• Parse finding severity metrics to adjust composite risk weighting dynamically.
• Flag framework control gaps across NIST, GDPR Article 28, and ISO 27001 models concurrently.

The routing record for a vendor in that state is boring, which is the point — every field below is derived, and none of it was typed by a reviewer:

{
  "vendor": "Globex Analytics",
  "status": "EVIDENCE_COLLECTING",
  "pipeline": "NIST_800-53_REV_5",
  "escalation_sla_hours": 48,
  "alerts_active": true
}

4. Quantifying the chasing phase

Across the sample, 71% of elapsed review time sat in exactly two states: waiting for the vendor to send a document, and waiting for a reviewer to notice that it had arrived. Neither state involves judgement. Both are eliminated by a system that fetches what is already published and escalates on a clock rather than on memory.

The remaining 29% — reading the report, weighing the exceptions, deciding whether the residual risk is acceptable — is the work you actually hired a security team to do, and it is the part that does not compress.

5. Summary and recommendation

Treat the chase as an infrastructure problem, not a discipline problem. Instrument the intake, publish the escalation clock, and let the reviewer see only the reviews that need a human. The median review in the automated cohort closed in two days, and the reviewers in it spent more absolute hours on analysis than the cohort that took six weeks.