Ask an organisation how it knows its suppliers are secure and you'll usually be shown a questionnaire. It was sent once, filled in once and filed. Beside it sit a spreadsheet, an attestation and a point-in-time assessment from the last audit. All of it describes what was true, or what someone believed was true, on the day it was written.
Cyber risk is scaling faster than the way we assure it. That's the gap I keep coming back to.
Everyone knows the risks
Offshore access raises cyber risk. Legacy systems raise it. Unpatched systems raise it further. None of this is news to anyone who works in security.
The hard part is proving, today, that a control is working. Not that a policy exists. Not that a supplier ticked a box last year. That the control does what it says, now.
Third parties are where it breaks
Much of our exposure sits with someone else: the maintenance provider, the managed service, the software vendor with remote access. Here's a test worth running. Could you list every internet-accessible system your maintenance providers operate on your behalf? Not the contracts. The systems.
If the answer is no, the questionnaire can't help, because nobody thought to ask the question.
From documents to evidence
Assurance has to move from documents to evidence. That means checking controls continuously rather than once a year, collecting the evidence while the systems run, and holding suppliers accountable for showing that their controls work, not just saying so.
AI can help redesign this. Reading logs, testing controls and flagging drift are jobs that suit software that doesn't get bored. But the rule for AI is the same as the rule for suppliers. If an AI system acts on our behalf, it needs logging, clear permissions, independent verification and a person accountable for what it does. 'Trust us' is a weak security model, whoever is saying it.
The question for every board isn't whether its suppliers filled in the form. It's whether anyone could show, this afternoon, that the controls are working.