Prevalent Customer Research
In your best estimate, how much time do you spend on vendor intake and onboarding?
| Less than 1 hour per vendor | 2-4 hours per vendor | 4+ hours per vendor | 1 day+ per vendor | 1 week or more per vendor | |
|---|---|---|---|---|---|
| Before Prevalent |
3% |
18% |
4% |
14% |
61% |
| Since Prevalent |
13% |
19% |
13% |
39% |
16% |
Prevalent Customer Research
In your best estimate, how much time do you spend on vendor sourcing and selection?
| Less than 1 hour per vendor | 2-4 hours per vendor | 4+ hours per vendor | 1 day+ per vendor | 1 week or more per vendor | |
|---|---|---|---|---|---|
| Before Prevalent |
0% |
9% |
8% |
25% |
58% |
| Since Prevalent |
0% |
35% |
15% |
31% |
19% |
Prevalent Customer Research
What were your primary vendor risk assessment pain points before working with Prevalent?
| Complex, manual assessment processes (e.g., using spreadsheets) |
|
|
| Too much time spent manually onboarding new vendors |
|
|
| Too much time spent scouring through disconnected sources of information to make good risk-based vendor selection decisions |
|
|
| Lack of visibility into the baseline risks with a new vendor |
|
|
| No real-time insight into vendor cyber, reputational and/or financial risks |
|
|
| Lack of insight into vendor success (e.g., measuring whether they live up to their contractual commitments) |
|
|
| No defined vendor offboarding process |
|
Prevalent Customer Research
Why was your organization not able to complete more assessments prior to utilizing Prevalent?
| A lack of staffing |
|
|
| Not enough time |
|
|
| Limited team expertise |
|
|
| A limited budget |
|
|
| It wasn't a priority |
|
|
| Other |
|
Prevalent Customer Research
If you are looking to grow the number of vendors you assess in the next year, by how much?
| We are not planning to grow the number of vendors we are assessing in the next year. |
|
|
| 1-10% |
|
|
| 11-25% |
|
|
| More than 25% |
|
Prevalent Customer Research
What is/was the typical turnaround time from assessment submission to receiving an adequately completed assessment?
| 1 day or less per assessment | 2-5 days per assessment | 6-10 days per assessment | 11-20 days per assessment | More than 20 days per assessment | |
|---|---|---|---|---|---|
| Prior to using Prevalent |
0% |
0% |
0% |
25% |
75% |
| Since using Prevalent |
0% |
8% |
54% |
38% |
0% |
Prevalent Customer Research
On average, how much time was/is devoted – per vendor – to sending assessments, finding and interacting with contacts, and verifying that questions were adequately answered?
| 1 hour or less per vendor | 2-3 hours per vendor | 4-5 hours per vendor | 6-8 hours per vendor | More than 8 hours per vendor | |
|---|---|---|---|---|---|
| Prior to using Prevalent |
12% |
22% |
22% |
22% |
22% |
| Since using Prevalent |
38% |
31% |
31% |
0% |
0% |
Prevalent Customer Research
Which of the following statements below do you agree with now that you are utilizing Prevalent?
| With the same resources, we are now able to spend time mitigating risks as opposed to validating information. We are focused on the right things. |
|
|
| We require fewer resources dedicated to collecting and analyzing questionnaires and vendor-submitted evidence. |
|
|
| My organization has been able to redirect resources previously dedicated to collecting and analyzing vendor-submitted questionnaires and evidence to other activities. |
|
Prevalent Customer Research
What were the top drivers for purchasing your Prevalent third-party risk management solution?
| Reduce operational burden: The process of assessing and evaluating vendors took too much time and resources |
|
|
| Stronger cybersecurity: Ensuring that third parties do not introduce cyber risks that could negatively impact the business |
|
|
| Compliance: Reporting against specific regulatory or industry framework requirements |
|
|
| Risk: The need for greater risk-based intelligence |
|
Prevalent Customer Research
What challenges did deploying Prevalent solve for your organization?
| A lack of automation in collecting and analyzing vendor surveys |
|
|
| A limited ability to continuously monitor vendors |
|
|
| An inability to share completed assessment content and supporting evidence to more quickly identify risks and vulnerabilities |
|
|
| An inconsistent methodology for vendor risk management |
|
|
| A lack of insights to make risk-based decisions |
|
|
| Having no centralization of TPRM functions |
|
|
| A lack of guidance in addressing industry standards or third-party regulatory compliance requirements for cyber risk, InfoSec, or data privacy |
|
