Are Your Vendors Lying to You?

Your vendor says they have MFA everywhere. They say their data is encrypted. They say the right things on every questionnaire you send. So why is there almost always a gap between what a vendor tells you and what is actually happening inside their environment? In this episode, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik dig into the uncomfortable space between attestation and reality. Jeffrey wants to call it lying. Bob and Ferhat push back hard, arguing most of it is bad data, missing inventory, and answers that are aspirational rather than dishonest. From there they get into the harder problem: how do you verify anything when you cannot send an auditor into Google or Amazon, and what happens to verification itself when the answers you receive were generated by AI in the first place? In this episode, you will learn: Why yes or no questionnaire answers measure compliance, not the efficiency of a control The three types of verification, from signals to behavior analysis to vendor testimony Why every signal needs a confidence level before you decide which battles to fight How to get real value from SOC 2 reports and where third-party audits fall short Why most programs are built to discover and ask questions, but never to follow up What happens to trust but verify when AI is producing the answers on both sides If your program collects a lot of vendor answers and verifies almost none of them, this conversation is worth your time.