Library › Cybersecurity AI › IT and security teams

Summarize a vendor's security answers against requirements

  • For IT and security teams
  • You practice Asking for a format you can use
  • Time about 5 minutes

About this exercise

Procurement needs a summary of this vendor's security questionnaire before signing. Check the answers against your 5 requirements and write exactly 5 numbered lines, one per requirement in order, each labeled 'Meets', 'Gap' or 'Unclear' with a short quote from the vendor. 'Unclear' means the answer doesn't say yes or no. Plain text, under 120 words.

Common mistakes when you ask AI for this

  • Trusting friendly answers. The AI reads 'Yes! We completed SOC 2' and calls R1 met, missing that it's Type I. Try: Say: "Check each answer word by word against the requirement."
  • No fixed labels. The AI writes 'mostly compliant' or 'some concerns', which procurement can't act on. Try: Give the labels: "Meets, Gap or Unclear. Unclear = no clear yes or no."
  • No evidence. Without quotes, nobody can check the call later. Try: Add: "Include a short quote from the vendor on each line."
  • Counting marketing claims. The AI treats 'never had a breach' as reassurance about breach notice. Try: Say: "Judge only the answers that address each requirement."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 120 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 90 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the procurement form they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the labels
  • Asks for quotes
  • Defines unclear
  • Says exactly how many
  • Asks for plain text

Practice this now ↑

Related exercises