By the time a deal reaches security review, the champion is sold and the business case is approved. The deal now moves to a team the seller has usually never met, evaluating the company against criteria the seller has usually never seen. That team can approve the deal in days or hold it for months, and every month of delay has a measurable cost.
Workstreet's cost model estimates that a typical company spends about $23,000 a year on the labor of completing questionnaires and loses roughly the same amount again in delayed revenue, for a total of about $46,000. Half of the cost of security review comes from waiting, not working.
This chapter is built on the work of Romeen Sheth, Co-founder and CEO of Workstreet, and Travis Good, its Co-founder and CISO. Workstreet is an AI-native security and compliance firm that runs security reviews for companies including Cursor and Clay, and it is Vanta's largest services partner.
In this section, we cover why security review security review is a revenue function, how it's become harder in the age of AI, how to build a review process that keeps deals moving, the mistakes that most often stall deals, and where AI helps or hurts.
How to win
Security review has historically been the final step between a verbal yes and a signed contract. For the buyer, it is where they decide whether they can trust a vendor with their data, and whether they can defend that decision if something goes wrong.
For the seller, the goal is to get the deal across the line without introducing new risk, such as a delay, a surprise requirement, or a contract term that reopens the negotiation.
Before AI, trust was relatively easy to communicate because buyers and sellers shared a clear set of standards. SOC 2 and ISO 27001 covered most software, HIPAA and HITRUST covered healthcare, and CMMC covered the federal government. If a vendor held the right certifications, the buyer's security team knew what they were getting.
AI has disrupted that shared standard. New frameworks such as ISO 42001 and AIUC-1 are emerging, but few buyers have settled on one.
The shift is happening quickly. Across the reviews Workstreet runs, fewer than 10% of buyers included a dedicated AI questionnaire in their procurement process a year ago. More than 50% do today, and Travis expects that figure to approach 100% within six months.
Because there is no settled standard in the AI era, buyers are often unsure what to ask. As a result, questionnaires vary widely from one company to the next, and one questionnaire frequently triggers another. However, buyers expect the same enterprise rigor that was defined in the SaaS era.
To approve a vendor with confidence, the buyer's security team needs four things:
Answers that are accurate, concise, and delivered quickly.
Evidence of a mature, well-run process.
A clear point of view on AI security, so they do not have to define one on your behalf.
A credible security practitioner they can speak with directly.
Prev
Next
Tactics
Prev
Next
Tactics
Workstreet's approach can be put into practice in eight steps. The first three establish how your team runs reviews. The next three prepare the materials buyers will ask for. The final two cover what to do when you have a gap and how to improve over time.
Step 1. Know where you are on the volume curve
The right level of investment depends on how many questionnaires your company receives each month. Travis uses the following model:
3 to 5
Manageable, but not a manual job
Build a growing Q&A catalog and use AI to draft answers, with a person reviewing every answer before it goes out. This foundation makes it easier to scale as volume grows
5 to 20
The window to build
Design a process that can handle 50 to 100, because early investment compounds
20 to 25 or more
A bottleneck
Deals start to stall, engineers are meaningfully pulled off their work, and sellers are pulled off pipeline
The most common mistake is waiting until volume reaches 40 or more before investing. In Travis's words, "My advice is always to start planning way ahead."
Step 2. Make security review a first-class part of the sales motion
Most sales organizations staff deal desk and RevOps, but few staff procurement or security review. Travis's central recommendation is to treat security review as primary function within the sales motion. In practice, that means naming an owner, defining the process from first request to signed contract, and modeling that process in a tool your team already uses, such as Notion or Linear.
Capacity also needs to match the sales calendar. Questionnaire volume rises at the end of each month and quarter, and a team sized for average demand will fall behind exactly when deals are trying to close. Notably, many AI native organizations bring on Workstreet's service through their sales leaders rather than their technical founders, because the problem they were solving was deal velocity.
Step 3. Set up the infrastructure before the first questionnaire arrives
Many delays in security review come from process gaps rather than difficult questions. Four pieces of infrastructure prevent most of these delays:
A shared inbox. A single address, such as questionnaires@company.com, monitored by one owner, keeps requests from scattering across the AE, the CRO, and the engineering team.
Shared credentials. A password manager such as 1Password lets the team access buyer portals that require multi-factor authentication without passing logins around insecurely.
An ownership matrix. The matrix defines who owns each section of a questionnaire (IT, legal, security, or operations), who is assigned each task, who reviews responses before submission, and who has the authority to submit.
Fast intake. An AE should be able to hand off a request by forwarding an email or posting in Slack, without filling out a form or filing a ticket.
Step 4. Build a knowledge base and keep it current
Start with a standard industry questionnaire, such as the Cloud Security Alliance's CAIQ. Workstreet is also open-sourcing its own version if you need a head start. Once engineering signs off on those answers, Travis estimates that you will already have answers to 80 to 90% of the questions buyers ask.
A complete knowledge base contains five components:
Component
What it holds
Approved answers
A standard questionnaire answered once and signed off by engineering
Evidence library
Policies, the SOC 2 report, the penetration test, the privacy notice, and other security documents, each linked to the answers that cite it
AI governance answers
Your positions on AI transparency, output testing, and AI policy (see Step 6)
"Does not apply" statements
A short explanation for each regulation that does not cover your business, such as DORA
Review record
The date each answer was last reviewed, who reviewed it, and the product release it reflects
The knowledge base should be maintained as an ongoing asset rather than a one-time project. Review it monthly, update it with every product release, and remove answers that are no longer accurate.
A good entry is short, accurate, and backed by evidence. For example:
Question: Do you use customer data to train AI models?
Answer: No. Customer data is not used to train models, as stated in our terms of service.
Evidence: A link to the relevant section of the terms of service.
Last reviewed: The date and the product release it was checked against.
A weak entry answers the same question with a paragraph describing the company's entire data architecture. It provides more information than the buyer asked for and invites follow-up questions.
Cursor offers a public example of this done well. Its security page lists its AIUC-1, ISO 27001, ISO 42001, and SOC 2 Type II credentials, with reports available through its trust portal.
Step 5. Prepare a readiness pack for the first day of review
A trust center, a SOC 2 report, and a recent penetration test are table stakes. Buyers expect to find them without asking, and they are the right materials to share at the start of any review.
These materials alone can undersell your security program. Travis points out that a trust center reflects compliance, and compliance is not the same as security. He recommends supplementing it with a public security page, a deck, or a white paper that explains your security practices in terms a buyer's security team will recognize. Done well, this material makes a company look more established than its size might suggest.
Template: Security review readiness pack
The readiness pack is everything a buyer's security team should receive on the first day of review without having to ask for it. Send it from your shared inbox as soon as review begins, and publish as much of it as possible on your trust center so buyers can find it on their own.
Part 1. The table stakes
Item
What to include
Trust center
A single link (for example, trust.yourdomain.com) where buyers can view your certifications and policies and request access to restricted reports
SOC 2 report
Your most recent SOC 2 Type II report, shared through the trust center
Penetration test
A summary or attestation letter from your most recent third-party penetration test
Part 2. The materials that show your security program, not just your compliance
Item
What to include
Security overview
A public security page, deck, or white paper that explains your security practices in terms a buyer's security team will recognize
AI security statement
Your answers to the three AI governance questions: how you are transparent about AI (models used, whether you train on customer data, data retention), how you test AI output and where a human is involved, and your AI security policy
Additional certifications
Any frameworks your buyers' region or industry expect, such as ISO 27001 for European buyers or ISO 42001 for AI governance
"Does not apply" statements
A short explanation for each regulation that does not cover your business, such as DORA
Privacy notice
Your current privacy notice and a description of how customer data is handled
Part 3. The materials that shorten the questionnaire
Item
What to include
Completed standard questionnaire
Your answers to a standard industry questionnaire, such as the CAIQ, which often answers most of the buyer's questions before they send their own
Named security contact
The person who owns your security program and can join a call with the buyer's security team
Response commitment
The shared inbox for questionnaires and your standard turnaround time
Subject: [Company] security review materials
Hi [Name],
Ahead of your security review, here is everything your team will need to get started:
Our trust center: [link], with access to our SOC 2 Type II report and our latest penetration test summary
Our security overview: [link]
Our AI security statement: [link]
Our completed CAIQ: [attached]
If your team has its own questionnaire, please send it to questionnaires@[company].com and we will return it within [X] business days. [Name], who leads our security program, is also available to join a call with your security team.
Best, [Name]
Step 6. Define your point of view on AI security before the buyer asks
The fastest-moving companies do not wait for buyers to define AI security for them. When Cursor launched its enterprise motion, its security page included a dedicated AI security section that set out what Cursor believed good AI security looked like. According to Travis, Cursor moves through security questionnaires faster than almost any other company Workstreet works with, and he attributes that speed to Cursor having a clear and public opinion on the topic.
At a minimum, every rep should be able to answer three questions about how the company governs AI:
Are you transparent about your use of AI? This question appears in nearly every questionnaire from European buyers because of the EU AI Act. Buyers want to know which models you use, whether you train on their data, and how long you retain it. In most cases, clear language in your terms of service is sufficient.
How do you test the output of your AI? Buyers want to know whether a human reviews the output and which decisions the AI makes on its own. The right answer is an accurate one, delivered with confidence.
Do you have an AI security policy? Many companies have not yet written one, and many reps do not know whether one exists.
Travis recommends building AI governance in stages. Start with a straightforward set of policies that your team will actually follow. Then pursue an external assessment such as ISO 42001. Companies whose core product is AI should then look at more demanding frameworks such as AIUC-1.
Step 7. Have a plan for when the answer is "no"
Questionnaires will sometimes reveal a gap in your controls. When that happens, a clear plan preserves the buyer's confidence. Document a remediation plan that names the gap, the fix, the owner, and the date it will be complete.
When the gap is a missing certification, run the certification and the conversation in parallel. For Bravado, Workstreet delivered a rapid assessment and an engagement letter within 48 hours. That gave the buyer's security team something concrete to review while the certification work was underway, instead of waiting for the certificate before the conversation could begin.
Step 8. Measure the process
Track the number of questionnaires completed, the average turnaround time for each, and the resources each one required. These three numbers show where the process is slowing down and whether changes are working.
How to win
Prev
Next
Common mistakes
Prev
Next
Common mistakes
1 Treating enterprise procurement like a startup process
What it looks like. The seller sends a rough answer and assumes they can clarify it later, the way a startup might iterate with a partner. Or the founder tries to establish credibility by pointing to how much money the company has raised.
Why it fails. Romeen's observation is that many startups do not respect the procurement process. Enterprise buyers do not collaborate on a weak answer. If they do not like what you sent, they may never respond again. Funding does not help either. Romeen has watched founders tell buyers they raised $100 million, and the buyer's response was that funding does not mean the company takes security seriously.
What to do instead. Treat every submitted answer as final. Demonstrate maturity through your process, your documentation, and a credible practitioner, not through your investors.
2 Leaving the AE to manage the review alone
What it looks like. The AE manages the review on top of every other deal they are working. Requests arrive in several inboxes and threads, and no one has been named to review answers or submit the final questionnaire.
Why it fails. The review slows down because it is never anyone's top priority. Travis describes the result as "death by a thousand cuts," because one questionnaire leads to another and each handoff adds days. The deal stalls on the calendar rather than on the quality of your security controls.
What to do instead. Give the review a dedicated owner, a shared inbox, and a clear ownership matrix, as described in Steps 2 and 3.
3 Being unprepared for questions about AI
What it looks like. The buyer asks whether the company has an AI policy or is transparent about its use of AI. The AE is not sure whether the answer is in the terms of service, so they hesitate to say yes and escalate the question internally.
Why it fails. According to Travis, questions about AI are where deals most often stall today. A slow response to a simple question signals to the buyer that the company has not thought about the issue, and every internal escalation adds time.
What to do instead. Add approved answers to the three AI governance questions in Step 6 to your knowledge base, and make sure every rep knows where to find them. In many cases, the answer already exists in your terms of service.
Tactics
Prev
Next
How to avoid AI slop
Prev
Next
How to avoid AI slop
Workstreet is an AI-native firm, and it uses AI throughout its own review process. Its position is not that teams should avoid AI. It is that AI should run the process while people remain accountable for what the company commits to. This distinction matters more in security review than almost anywhere else in the deal, because a submitted answer can become a contractual commitment.
Use AI to run the process, and have a person approve every answer
Workstreet uses AI for intake, pre-processing, matching questions to existing answers, and tracking follow-ups. An expert then reviews every response before it is submitted. This combination delivers the speed of automation without sending the buyer an answer that no one at the company has checked.
Keep the knowledge base behind your AI current
An AI tool that matches questions to past answers is only as accurate as those answers. If the knowledge base has not kept pace with product releases, the tool will repeat outdated claims with confidence. Each inaccurate answer creates follow-up questions and damages the buyer's trust. The maintenance practices in Step 4 are what keep AI-assisted answers accurate.
Do not let AI define your point of view on AI security
Cursor's speed through review comes from a clear opinion, written by its own team, on what good AI security looks like. A model asked to write that point of view will produce language that reflects the general consensus of the category, and that vagueness is exactly what buyers are already frustrated by. Your stance on AI security should be written by the people who are accountable for it.
Close
Security review is where a buyer confirms that a vendor can be trusted with their data. The companies that move through it quickly treat it as a revenue function, build their process before questionnaire volume forces them to, and establish a clear point of view on AI security before the buyer asks for one.
Go deeper with Workstreet. Read Workstreet's GUARD maturity model at workstreet.com/guard
