Evident Research

The Hidden Cost Explosion

AI is exploding the volume of security findings and fixes. But every one still has to become proof: reviewed, approved, evidenced, and defensible to customers, suppliers, auditors, regulators, and insurers. The security back office was never built to scale manually at this speed.

2022202320242025202620272028
2022 baseline3.4x admin burden by 20284 proof channels
Findings to triage5.4x
Supplier and customer proof2.3x
Regulatory evidence work2.4x
Insurance evidence work2.0x
interactive dataset

See why security admin work is compounding.

evidence behind the model
263%

CVE submission growth

NIST reported CVE submissions increased 263% from 2020 to 2025.
37.4h

vendor assessment work each week

Whistic 2025 TPRM survey: average weekly vendor-assessment work.
84%

initial assessments needing follow-up

Whistic 2025 TPRM survey: initial supplier assessments requiring follow-up.
24/72h

reporting clocks

NIS2 and Cyber Resilience Act reporting sequences include 24-hour early warning and 72-hour notification windows.
view

Supplier and customer proof turns one issue into repeated asks.

Public supplier-review and questionnaire proxies show assessment hours, follow-up, response lag, and large evidence request surfaces.

Download CSV
Relationship surface286

average vendors

Each relationship can create assessment, follow-up, evidence, and owner-routing work.

Workload37.4h

vendor assessment work each week

Whistic survey benchmark for recurring vendor-assessment effort.

Friction84%

initial assessments requiring follow-up

Follow-up is where questionnaire work turns into repeated communication and interpretation.

Delay12 days

average vendor response lag

Response lag creates wait states, reminders, and stale evidence questions.

Questionnaire surface

CAIQ adds another cloud-assurance question surface.

328 CAIQ questions

Survey aggregates and public metadata only. No proprietary questionnaire content is copied.

drilldown

How to read this exhibit

The exhibit groups unlike measures by what they mean operationally: relationships, work, friction, delay, and question surface.

  • Question counts, hours, response lag, and follow-up rates are different units.
  • Together they show why proof requests create recurring administration.
  • The point is operational burden, not a ranked bar chart.
one level above compliance

Optimization target: economic impact, not just passing proof.

Evident's trust graph should not stop when proof exists. It should ask whether proof was rejected, whether an incident created real cost, whether admin cost missed its target, and where reusable evidence can reduce the next cycle.

triggerobligationworkproofeconomic impact
evidence sources

Sources behind the public numbers.

Public claims stay attached to the reports, regulator materials, and standards references used for the figures and clocks above.

PublisherSourceUsed for
AI Incident DatabaseAI Incident Database Snapshotspublic-number evidence
CISAKnown Exploited Vulnerabilities Catalogpublic-number evidence
Cloud Security AllianceSTAR Level 1 Security Questionnaire CAIQ v4public-number evidence
CVE ProgramCVE List V5public-number evidence
European CommissionCyber Resilience Act Reporting Obligationspublic-number evidence
European UnionDigital Operational Resilience Actpublic-number evidence
European UnionNIS2 Directivepublic-number evidence
FIRSTEPSS Current Scorespublic-number evidence
HHS OCRBreach Portal Notice to the Secretary of HHS Breach of Unsecured Protected Health Informationpublic-number evidence
MITRECWE Listpublic-number evidence
MITREMITRE ATLAS Datapublic-number evidence
NAICCyber Insurance Reportpublic-number evidence
NAICReport on the Cybersecurity Insurance Marketpublic-number evidence
NISTNVD CVE API 2.0public-number evidence
OMB/OIRAOMB/OIRA Paperwork Burden Inventorypublic-number evidence
OWASP FoundationOWASP Top 10 for LLM Applicationspublic-number evidence
SECCybersecurity Risk Management, Strategy, Governance, and Incident Disclosurepublic-number evidence
Shared AssessmentsWhat's New in the 2025 SIG Updatepublic-number evidence
WhisticThird-Party Risk Management 2025 Impact Reportpublic-number evidence