Why No Single Cycle-Time Number Exists Yet
A benchmarked average, security review adds X weeks to a deal, would be the most directly useful figure on this page, and it is also the one figure that could not be confirmed from a primary or authoritative source this cycle. The reports that do exist track risk perception, spend priority, and questionnaire scale in detail. None of the sources checked here publish a clean duration metric, likely because the process itself still varies too widely by industry, deal size, and organizational maturity to reduce to one honest number yet.
What the Data Does Confirm About Where the Time Goes
The closest available proxy for cycle time is scale and priority, not duration. An 800-question SIG questionnaire, Vanta’s own guide confirms, is not answered in an afternoon, and Vanta’s own automation product markets an 81% faster completion claim, indirect evidence that the manual default is measured in a meaningful span of time. Layer in KPMG’s finding that 52% of organizations name risk assessment their single largest area of third-party risk spending, and the picture is consistent even without a stated weeks figure: this is a resourced, prioritized, and still-formalizing process, not a quick formality.
The Numbers
72% of security decision-makers say security risk for their company has never been higher, up from 55% in 2024, a 17-point increase, per a survey of 3,500 IT and business leaders across five countries.
61% of security decision-makers say they spend more time “posturing,” proving trust and compliance externally, than actually protecting their organization.
59% of security decision-makers say AI-driven cyber threats are advancing faster than their own security team’s expertise to counter them.
A single Standardized Information Gathering questionnaire, the industry-standard vendor security review document, can run past 800 questions.
Vanta’s own Questionnaire Automation product claims to complete security reviews 81% faster, automatically answering more than 80% of security questions with up to a 95% acceptance rate on AI-generated answers.
52% of organizations name risk assessment and due diligence their single largest area of third-party risk spending, ahead of tooling, cybersecurity, and audits combined.
Only 18% of organizations have achieved full integration between third-party risk management and enterprise risk management, while 71% plan further integration over the next three years.
83% of executives plan to expand their partner and vendor networks over the next one to three years, even as governance around those relationships keeps formalizing.
Sources
The external data in this article draws on the sources below. Figures described in the text as estimates or industry triangulations are directional and are not attributed to a single dataset.
- Vanta, State of Trust Report (Third Edition)
- Vanta, Security Reviews: A Practical Guide
- KPMG, 2026 Global Third-Party Risk Management Survey