From weeks of manual security questionnaires to AI-assisted answers in 2 days

Executive summary

A B2B software and services organization needed to reduce the time and operational effort required to answer customer security questionnaires. These questionnaires were long, varied in format, and often required answers based on information already available somewhere in internal documentation, email history, Confluence pages, or public security and compliance materials.

Before the change, a large questionnaire of around 200 questions could take one to two weeks of team effort. Answers were recreated ad hoc, ownership was unclear, and different people could provide different answers to similar questions.

The organization built an AI-supported tool that automatically identifies questions in uploaded questionnaire files and drafts answers using one approved knowledge base. Human experts are involved only when the answer is missing, ambiguous, or requires specialist interpretation.

• The tool went through 12 releases in 3 months, evolving through real use rather than being launched as a finished product.
• The process moved from one to two weeks of team work to two days of work for one person.
• In a sample 200-question questionnaire, AI completed 190 questions without human involvement.

Client background

The organization provides B2B software and services and regularly receives security questionnaires from customers. These questionnaires are used to verify compliance with security policies, GDPR requirements, and industry standards before or during cooperation.

The company already had much of the required knowledge available across internal documentation and public-facing security materials, such as subprocessors, security controls, and compliance information. The problem was that the knowledge was scattered, difficult to reuse consistently, and time-consuming to apply to every new questionnaire.

The challenge: manual effort, inconsistent answers, and regulatory risk

Security questionnaires had no single clear owner for a long time. The task moved between teams until one team took responsibility for the process. Each new questionnaire repeated the same pattern: several people searched through emails, files, and Confluence pages to find answers that had often already been written before, but were hard to locate.

• High manual workload: a large questionnaire of around 200 questions required one to two weeks of team effort.
• No single source of truth: answers were created ad hoc and often rebuilt from scratch for every questionnaire.
• Inconsistent responses: different people could answer similar questions differently across different questionnaires.
• Compliance risk: inconsistent declarations to customers created regulatory and contractual risk, not only process inefficiency.
• Multiple file formats: questionnaires arrived as .xlsx, .docx, .pdf, and .csv files, so even identifying which fields were actual questions consumed time.
• Expert time used inefficiently: security specialists spent time copying information into forms instead of focusing on work that required their expertise, such as security architecture.

The problem: security expertise trapped in repetitive administration

The organization needed a process that could make approved security knowledge reusable, reduce dependency on multiple people, and keep answers consistent across customers and questionnaire formats.

The goal was to stop using expert time for repetitive searching, rewriting, and copying. Experts should review only the questions where the AI cannot find a confident answer or where interpretation is required.

The solution

The organization created an AI-supported questionnaire automation tool based on Retrieval-Augmented Generation (RAG). The tool uses an AI Knowledge Base built from approved internal documentation and public security and compliance materials. This gives the AI a controlled source of truth instead of relying on open-ended generation.

The solution supports full questionnaire files. A user uploads a questionnaire in formats such as .xlsx, .docx, .pdf, or .csv. The tool identifies the questions, searches the approved knowledge base, generates answers, and returns a completed questionnaire for review.

The process evolved through three practical stages:

1. Chat AI: users copied individual questions into a chat, received AI-generated answers, and manually pasted them back into the questionnaire. This was faster than searching manually, but still repetitive and exposed the process to missed questions.
2. Whole-file questionnaire handling: a full questionnaire file is uploaded into the system. AI identifies the questions, fills in the answers, and returns a ready-to-review questionnaire in minutes instead of days.
3. Operationalized ownership and escalation: the process now has one day-to-day owner, a designated backup, and a clear escalation path to experts only where their knowledge is truly needed.

Delivery timeline

Business impact: a repeatable AI-supported questionnaire process

The organization turned a fragmented, team-dependent process into a repeatable AI-supported workflow with clear ownership. Security questionnaires can now be handled by one person, with experts involved only when needed.

Quick wins delivered through the AI-supported model

• Faster questionnaire completion: large questionnaires can be handled in days instead of weeks.
• Higher answer reuse: approved security knowledge is reused instead of recreated for every customer request.
• More consistent customer communication: responses come from one trusted knowledge base.
• Clear process ownership: one person can run the process with a defined backup and escalation path.
• Better use of security expertise: specialists focus on exceptions and interpretation instead of repetitive form filling.

Goals and success metrics