--- title: "The security questionnaire arrived: what an AI-built product can answer in 30 days (2026)" description: "In 30 days an AI-built product can answer an enterprise security questionnaire honestly: fix the few real gaps, attach evidence, and date a SOC 2 plan." url: https://systemtrails.com/resources/security-questionnaire-ai-built-product-30-days/ markdown: https://systemtrails.com/resources/security-questionnaire-ai-built-product-30-days/index.md type: resources date: 2026-09-07 lastmod: 2026-09-28 tags: ["enterprise","security-questionnaire","soc-2","ai-mvp","security"] --- # The security questionnaire arrived: what an AI-built product can answer in 30 days (2026) > In 30 days an AI-built product can answer an enterprise security questionnaire honestly: fix the few real gaps, attach evidence, and date a SOC 2 plan. An AI-built product can answer an enterprise security questionnaire in 30 days if it treats the questionnaire as a list of evidence requests: fix the handful of real gaps, attach proof to every yes, and answer every no with a dated plan. A SOC 2 report does not fit in 30 days, since even Type 1 takes 3 to 6 months, so the honest answer is a roadmap, not a promise. Pilots are won on credible answers, not on a perfect score. **TL;DR** - **You will not have SOC 2 in 30 days.** Type 2 includes an observation period of at least 3 months; say so and date the plan - **Most questions are evidence requests.** Answer with a document, a screenshot, or a test, not an adjective - **AI-built products fail the same six questions**: isolation, restore, incident plan, production access, admin logging, subprocessors - **Week by week**: triage, fix, write the evidence pack, answer and walk the reviewer through it - **Say how AI was used** and what controls sit around it; vagueness is the real red flag ## Why this deadline feels impossible The questionnaire arrives the week the pilot gets real. The buyer's team does this at volume: Vanta's State of Trust 2025, a survey of 3,500 IT and business leaders released October 29, 2025, found organizations spend **9 working weeks a year on vendor security reviews and risk assessments**, up from 7 the year before ([Vanta via Yahoo Finance](https://finance.yahoo.com/news/vanta-state-trust-2025-ai-130000473.html)). Your reviewer has seen hundreds. They are not reading for perfection. **They are reading for whether you know your own system.** The formats vary. It may be the buyer's own spreadsheet, the Shared Assessments SIG, whose [2026 edition](https://sharedassessments.org/blog/2026-sig-workbook-updates/) adds ISO 42001 references for AI governance, or the CSA's [CAIQ v4 with 261 questions](https://cloudsecurityalliance.org/blog/2021/09/01/what-is-caiq). If your product sends customer data to a model, expect AI questions too: the CSA's [AI-CAIQ v1.1 has 320](https://cloudsecurityalliance.org/blog/2026/07/14/ai-controls-matrix-v1-1-strengthening-the-foundation-for-trustworthy-ai), mapped to 247 control objectives. ## The 30-day path ```mermaid flowchart LR Q["Questionnaire
arrives"] --> T["Week 1: triage
yes / fixable / plan"] T --> F["Week 2: fix the
fixable gaps"] F --> E["Week 3: write the
evidence pack"] E --> A["Week 4: answer,
then a 30-minute call"] T -. "needs months,
e.g. SOC 2 Type 2" .-> R["Dated roadmap
in the answer"] R --> A A --> P["Pilot signed with
conditions and dates"] ``` **Sort every question into three piles on day one:** already true (needs evidence), fixable this month, and needs a dated plan. The third pile is usually short, and SOC 2 is almost always in it. ## The four weeks ### 1. Week 1: triage Read every question once. Mark each yes, fixable, or plan. List the systems it touches: database, auth provider, hosting, AI providers, email. **The list of systems becomes your architecture map.** ### 2. Week 2: fix Close the gaps a reviewer can test: tenant isolation, MFA on every admin console, production credentials out of AI tools and CI, a restore actually run. ### 3. Week 3: evidence pack Architecture and data-flow map, subprocessor list, incident response plan, access list, restore log, the isolation test output. One folder, dated. ### 4. Week 4: answer and walk through Answer in the buyer's format, link each yes to its evidence, and offer a 30-minute call. **In our experience, a call with the person who knows the system closes more questions than any document.** ## The six questions AI-built products usually answer "no" These are the gaps we see most often when a working AI-built product meets its first enterprise reviewer. Every one of them is small. | What the questionnaire asks | Evidence that answers it | |---|---| | How is customer data isolated between tenants? | A test with two tenants that fails if A can read B, run in CI | | Are backups tested? | A restore log: date, source, duration, who ran it | | Do you have an incident response plan? | Two pages: who is called, how customers are told, within what time | | Who has write access to production? | A list of people and machines, with MFA, and no AI agent on it | | Are administrative actions logged? | Where the logs live, how long they are kept, one sample entry | | List your subprocessors | Hosting, database, email, and every AI model provider that sees customer data | The production-access row matters more for AI-built products than for others. In July 2025 an AI agent deleted SaaStr's production database during a code freeze; the [dated incident list](/resources/ai-built-app-incidents-2025-2026/) shows that pattern and two others reviewers now ask about by name. ## How to answer the questions you cannot say yes to Every questionnaire has questions you will answer "no" in week four. **A dated plan beats a hopeful yes, every time.** Reviewers verify the yeses during the pilot; a yes that turns out to be false ends the relationship. **The answer that stalls the deal:** SOC 2: In progress. Penetration test: Planned. Data retention: We take security very seriously and follow industry best practices. **The answer that moves it:** SOC 2: Type 1 readiness started September 2026, auditor selection by November, Type 2 observation window to follow. Penetration test: scheduled before general availability; the scope is attached. Data retention: customer data deleted 30 days after contract end; the deletion job and its log are attached. For SOC 2 specifically, be exact about the calendar. Drata's March 13, 2026 figures: **Type 1 takes 3 to 6 months and costs $7,500 to $60,000; Type 2 takes 6 to 15 months**, including a 3 to 12 month observation period ([Drata](https://drata.com/learn/soc-2/type-1-vs-type-2)). The same page notes mid-market buyers may accept a commitment to reach Type 2 within a set timeframe, which is exactly what a dated roadmap is. ## Say how the product was built Questionnaires increasingly ask about AI directly: in the product, and in how it was made. **Answer plainly.** Name the tools, then the controls around them: every change reviewed by a named person, dependency and secret scans in CI, no AI tool holding production credentials, a senior review on a date. This is the same evidence an investor's reviewer asks for in [technical due diligence](/resources/technical-due-diligence-ai-built-codebase/), and the same [architecture map](/resources/architecture-map-template/) answers both. Build the evidence pack once; the next questionnaire takes days, not weeks. **The one thing to do today** Open the questionnaire and sort every question into **yes, fixable, or plan**. Count the fixable pile. If it has more than ten items, or anything about tenant isolation, start there tomorrow: it is the question reviewers test, not just read. ## When this is worth outside help The enterprise pilot is one of five trigger moments, with due diligence, first engineering hires, an incident, and scale. The questionnaire asks the same things the other four do, just with a deadline. If the fixable pile is large, the work is a fixed-scope fix pass of two to three weeks; [what that costs in 2026](/resources/cost-to-make-ai-built-app-production-ready-2026/) is published. If you want a senior architect to sort your pile against your actual code first, that is what the [free teardown](/free-teardown/) is: three findings and a verdict, recorded, within 72 hours. ## Sources - Vanta, State of Trust 2025, via [Yahoo Finance / Business Wire](https://finance.yahoo.com/news/vanta-state-trust-2025-ai-130000473.html), October 29, 2025: 3,500 respondents, 9 working weeks a year on vendor security reviews (7 the year before) - Drata, [SOC 2 Type 1 vs. Type 2](https://drata.com/learn/soc-2/type-1-vs-type-2), March 13, 2026: timelines, observation periods, cost ranges, buyer expectations - Shared Assessments, [2026 SIG workbook updates](https://sharedassessments.org/blog/2026-sig-workbook-updates/), July 18, 2025: ISO 42001 reference, Lite, Core and Detail scoping modes - Cloud Security Alliance, [What is CAIQ](https://cloudsecurityalliance.org/blog/2021/09/01/what-is-caiq), September 1, 2021: CAIQ v4, 261 questions, STAR Level 1 - Cloud Security Alliance, [AI Controls Matrix v1.1](https://cloudsecurityalliance.org/blog/2026/07/14/ai-controls-matrix-v1-1-strengthening-the-foundation-for-trustworthy-ai), July 14, 2026: 247 control objectives, 18 domains, AI-CAIQ with 320 questions - Fortune, [Replit wiped SaaStr's database](https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/), July 23, 2025 ## FAQ **Can a small AI-built product pass an enterprise security questionnaire without SOC 2?** Often, for a pilot. Drata (March 13, 2026) notes that enterprise procurement overwhelmingly expects a SOC 2 Type 2 report, while mid-market buyers may accept less with a commitment to reach Type 2 within a set timeframe. What gets a pilot through without the report is honest answers, evidence attached to each one, and a dated plan for the controls you do not have yet. **How long does SOC 2 take for a startup?** Drata's March 2026 figures: Type 1 takes 3 to 6 months in total and costs $7,500 to $60,000; Type 2 takes 6 to 15 months, including an observation period of 3 to 12 months, and costs $12,000 to $100,000 or more. Neither fits inside a 30-day questionnaire deadline, which is why the answer is a dated roadmap rather than the report. **What questionnaire format will an enterprise send?** Usually the buyer's own spreadsheet, or a standard one: the Shared Assessments SIG (its 2026 edition adds ISO 42001 references for AI governance and Lite, Core and Detail scoping modes) or the Cloud Security Alliance CAIQ v4, which has 261 questions. Buyers asking about AI features increasingly use the CSA AI-CAIQ, 320 questions mapped to the AI Controls Matrix. **Should I say the product was built with AI coding tools?** Yes, if asked, and describe the controls around it: who reviews changes, what scans run, how production credentials are separated from the tools. Reviewers know the 2025 to 2026 incidents with AI-built apps. A calm, specific answer about review and access control reads as mature; a vague one reads as a gap. **What are the questions an AI-built product most often has to answer no to?** In our experience: tenant isolation proven by a test, backups with a dated restore, an incident response plan, access control on production (who and what can write to it), logging of admin actions, and a list of subprocessors, including the AI model providers the app sends customer data to. All six can be fixed or documented in under a month. **What does it cost to get an AI-built product questionnaire-ready?** SystemTrails starts with a free recorded teardown: three ranked findings and a fix-or-rebuild verdict within 72 hours, two per week. The fix work is a fixed-scope Hardening Sprint priced from $2,500, quoted after the teardown, and produces the evidence documents the questionnaire asks for. Free teardown: https://systemtrails.com/free-teardown/ | Contact: https://systemtrails.com/contact/ | Book a call: https://cal.com/dan-podina-snqasy/30min