PlatformQuestionnaires

Ask about the inside. Check it against the outside.

Questionnaires cover the policies and controls a scan can't see.

DarkRisk keeps every answer next to its evidence, suggests answers from the vendor's own documents, and puts the scan right beside them.

Answers that showwhere they came from.

Suggested answers are drafted from the documents a vendor uploads, and each one points to the passage it came from. Hover an answer to find its source.

Information security policy.pdfUploaded by the vendor

4.2 All remote access to company systems requires multi-factor authentication, enforced by the identity provider.

4.5 Access rights are reviewed by system owners every quarter, and leavers are removed within one working day.

7.1 Production data is backed up daily, encrypted at rest, and restore tests are carried out twice a year.

9.3 Customers are notified of a confirmed security incident affecting their data within 72 hours.

What they say.What we see.

Answers and scan results live in the same record, so a contradiction is impossible to miss. Move over or tap the questionnaire to look underneath.

3of 4 answers don’t match what can be seen from the outside.

External scanObserved 14 Sep 2026

3389/tcp openRemote desktop reachable from the internetNo MFA challenge before the sign-in promptContradicts answer 1

Web serverRunning a release with published CVEsFixed version available for over a yearContradicts answer 2

_dmarcPolicy set to p=noneForged mail is reported, not rejectedContradicts answer 3

443/tcpTLS 1.2 and 1.3 onlyConsistent with the answerMatches

Security questionnaireSubmitted 12 Sep 2026

1. Is multi-factor authentication required for remote access?Yes, for all remote access.Access control policy.pdfAnswered

2. How quickly are critical vulnerabilities patched?Within 7 days of release.Patch management standard.pdfAnswered

3. Is your domain protected against email spoofing?Yes. SPF, DKIM and DMARC.Email security baseline.docxAnswered

4. Is TLS 1.2 or later enforced for all services?Yes.Encryption standard.pdfAnswered

Scan view

Illustrative data for a fictional vendor.

Review

Your team decides.

Nothing is accepted until a person accepts it. Reviewers see the answer, the evidence and the scan together, and sign-off is recorded with all three.

Suggested answers marked until reviewed
Documents kept private to the assessment
Sign-off recorded with the evidence