The Hidden Cost Explosion
AI is exploding the volume of security findings and fixes. But every one still has to become proof: reviewed, approved, evidenced, and defensible to customers, suppliers, auditors, regulators, and insurers. The security back office was never built to scale manually at this speed.
See why security admin work is compounding.
CVE submission growth
NIST reported CVE submissions increased 263% from 2020 to 2025.vendor assessment work each week
Whistic 2025 TPRM survey: average weekly vendor-assessment work.initial assessments needing follow-up
Whistic 2025 TPRM survey: initial supplier assessments requiring follow-up.reporting clocks
NIS2 and Cyber Resilience Act reporting sequences include 24-hour early warning and 72-hour notification windows.Supplier and customer proof turns one issue into repeated asks.
Public supplier-review and questionnaire proxies show assessment hours, follow-up, response lag, and large evidence request surfaces.
average vendors
Each relationship can create assessment, follow-up, evidence, and owner-routing work.
vendor assessment work each week
Whistic survey benchmark for recurring vendor-assessment effort.
initial assessments requiring follow-up
Follow-up is where questionnaire work turns into repeated communication and interpretation.
average vendor response lag
Response lag creates wait states, reminders, and stale evidence questions.
CAIQ adds another cloud-assurance question surface.
Survey aggregates and public metadata only. No proprietary questionnaire content is copied.
How to read this exhibit
The exhibit groups unlike measures by what they mean operationally: relationships, work, friction, delay, and question surface.
- Question counts, hours, response lag, and follow-up rates are different units.
- Together they show why proof requests create recurring administration.
- The point is operational burden, not a ranked bar chart.
Optimization target: economic impact, not just passing proof.
Evident's trust graph should not stop when proof exists. It should ask whether proof was rejected, whether an incident created real cost, whether admin cost missed its target, and where reusable evidence can reduce the next cycle.
Sources behind the public numbers.
Public claims stay attached to the reports, regulator materials, and standards references used for the figures and clocks above.