Security Questionnaire Agent
Answers the eighty questions you have answered eighty times
- 6hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 7output fields
- A structured result, not a paragraph you have to re-read
- ≤5steps per run
- Bounded work: at most 4 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
A security questionnaire arrives when a deal is nearly closed, and it costs days. Most of it is the same ground — access control, encryption, backups, incident response — asked in a different vendor's wording every time.
This agent answers from your stated security posture, matching each question to the control that actually addresses it. Where your posture covers the question, you get a draft answer with the control it rests on. Where it does not, the agent says so and routes it to a person.
That refusal is the product. Claiming a control you do not have is a misrepresentation to a customer that resurfaces in an audit or after an incident — so the agent never fills a gap to look complete. It separates answers it can evidence from answers that need review, and tells you which gaps are costing you deals.
Benefits
days, not weeks
Days back per questionnaire
Review a draft instead of composing two hundred answers.
Consistent across customers
The same control described the same way every time, which is what auditors check.
Nothing overclaimed
No control asserted that you cannot evidence.
What it does
Answers from your posture, not from the internet
Every response traces to a control you told it you have.
Refuses what it cannot evidence
An uncovered question is returned as uncovered, never answered plausibly to look finished.
Separates evidenced from needs-review
Your security lead reviews the short list instead of all two hundred rows.
Normalises the wording
Recognises the same control asked in SIG, CAIQ and bespoke phrasing, so answers stay consistent across customers.
Names the gaps that cost deals
Reports which unanswered controls appear most often, so remediation is prioritised by revenue rather than by framework.
What this changes
What this changes about your week
- It takes over
- Answering a buyer's security questionnaire from your own evidence.
- Done today by
- Whoever knows the estate — usually your most expensive engineer.
- How often
- Every enterprise deal, and every renewal.
- Typical manual effort
- A three-hundred-question questionnaire is a week of interruptions.
Why Cybersecurity in particular. These land at the worst point in a deal and they block it. Answering them from evidence rather than memory shortens the deal and the argument.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Security Questionnaire Agent has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolsextract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output.
Input
{
"posture": {
"controls": [
"MFA on all admin access",
"AES-256 encryption at rest",
"Daily backups"
],
"certifications": [
"SOC 2 Type II"
]
},
"questions": [
"Is data encrypted at rest?",
"Do you perform annual penetration testing?",
"Are backup restores tested?"
]
}Output
{
"answers": [
{
"answer": "Yes. Data at rest is encrypted using AES-256.",
"status": "answered",
"basedOn": "AES-256 encryption at rest",
"question": "Is data encrypted at rest?"
},
{
"answer": "",
"status": "uncovered",
"missing": "No penetration testing is listed in the posture. This cannot be answered.",
"question": "Do you perform annual penetration testing?"
},
{
"answer": "Backups are taken daily.",
"status": "partial",
"missing": "The posture states backups exist but not that restores are tested. A backup is not a tested restore.",
"question": "Are backup restores tested?"
}
],
"coverage": {
"partial": 1,
"answered": 1,
"escalated": 0,
"uncovered": 1
},
"disclaimer": "Drafted from the supplied posture for review. Not an assessment, certification or attestation of controls."
}Requirements
Integrations
No integrations required.
Before you start
- Your security posture: controls you operate, certifications held, policies in force
- The questionnaire, as a list of questions
- Requires the All-Access plan or higher
Use cases
Enterprise deal in procurement
Turn a 200-row questionnaire around without stalling the close.
Building a reusable answer library
Normalise past answers into one posture the whole team uses.
Prioritising security work
See which missing controls block the most revenue.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Will it answer questions we cannot actually satisfy?
No, and that is the point. An uncovered question is returned as uncovered with a note on what would be needed to answer it. Claiming a control you do not have is a misrepresentation to your customer that resurfaces in an audit.
Does this replace our security lead?
No. It drafts, and marks what needs judgement. Every response should be reviewed before it goes to a customer — the agent tells you which ones need the most attention.
Is this a compliance certification?
No. It helps you respond to questionnaires accurately. It does not assess, certify or attest to your controls, and it is not a substitute for an audit.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent