Vendor security review
Every finding points to its page.
The operator reads the vendor's SOC 2 report against its questionnaire and your controls, marks where they disagree, and drafts the follow-ups. Your analyst signs off.
ISO 27001 · GDPR · Every run auditable
SOC 2 Type II report, Lumora Analytics
Illustrative review
- 1Confirm the date MFA was enforced on the 3 admin accounts in the CC6.1 exception.
- 2Send assurance for the US sub-service organisation (its own SOC 2 or a bridge letter).
- 3Accept a 24-hour breach notice in DPA clause 9.1.
- 4Send the 2026 penetration test summary.
Assessment draft saved to your vendor register, waiting for sign-off
- up to 92%less time per vendor assessment
- 3–10×more assessments per team
- 14 daysto onboard a vendor, down from 60
- 50–80%less manual work
Enterprises running operators on Alomana
Six things it does on a review
A questionnaire is what the vendor says. The operator checks it against what the documents show.
- 01The questionnaireReads every answer, in Excel, Word or PDF
- 02The evidenceReads the SOC 2 report, certificates, pen test and policies
- 03Your standardChecks both against your own controls and policies
- 04The gapsFlags exceptions, carve-outs, expired documents and contract terms
- 05The follow-upsDrafts the questions to the vendor and a risk tier with its reasons
- 06The recordDrafts the assessment, each finding linked to its source
How the operator works a vendor review
- 1
Connect
SharePoint, Google Drive, OneTrust, your policies.
- 2
Find the gaps
Reads the documents against your controls.
- 3
Approve the follow-ups
You say yes. It sends and logs it.
Nothing goes to a vendor without a yes.
- Sends and writes wait for a person's yes
- A declined action is not retried
- Every run logged: input, output, tools, user
- Run record · VR-0318
- Input
- 4 documents from Lumora Analytics
- Output
- 4 findings, 4 follow-ups, assessment draft
- Send
- Waits for a person's yes
- User
- S. Moretti, third-party risk
- Measured on
- Days per assessmentAnalyst hours per vendorVendors reviewed per quarterOpen findings past due
- Works with
- OneTrustCoupaIroncladSharePointGoogle DriveJiraSlackYour GRC tool via MCP
- Trusted for
- ISO 27001GDPRNever trains on your dataSingle-tenant for enterprise
A custom operator typically goes live in up to 4 weeks.
Questions
What is an AI vendor risk operator?
An autonomous agent that works your vendor security reviews. It reads the vendor's questionnaire, SOC 2 report, certificates and contract, checks them against your controls, and drafts the findings, the follow-up questions and the assessment for your analyst to sign off.
How is it different from questionnaire software?
Questionnaire tools collect the vendor's answers. The operator reads the evidence behind them, such as the exceptions and carve-outs in a SOC 2 report or a breach clause in the DPA, and shows where the answers and your controls disagree.
Does it contact vendors without approval?
No. Sends and writes through Alomana's connectors, such as follow-ups to a vendor or an update in your vendor register, wait for a person's yes. A declined action is not retried, and every run is logged: input, output, tools and user.
Which systems does it connect to?
Alomana has 20+ connectors, including OneTrust, Coupa, Ironclad, SharePoint, Google Drive, Jira and Slack, activated per deployment. Systems outside the library, such as your GRC tool, connect through a remote MCP server.
Can it answer the questionnaires our customers send us?
Yes. The same operator can draft answers to an inbound security questionnaire from your own policies, reports and past answers, each with its source, for your security team to review and approve before it goes out.
Is our vendor and security data private?
Alomana is ISO 27001 certified and GDPR-compliant, and your data is never used to train AI models. Enterprise deployments run single-tenant, in a dedicated instance.
Bring one vendor's SOC 2 report.
Talk it over with sales: what the operator needs from your systems, and how it goes live.
Alomana is a secure enterprise AI platform where autonomous agents, called operators, run business processes end to end. Every run is fully auditable.