A security questionnaire is really two jobs in one envelope: writing down what is true about your product, and convincing somebody who has every reason to be sceptical. Winnow does both.
Send the questionnaire in whatever form it arrived — a spreadsheet, a document, a link to somebody’s portal — and point us at your product. Every question comes back with an answer, in their format, ready to send. No blank page, no lost week.
Plenty of these questions have an answer that can be established rather than asserted. Wherever that is true, Winnow goes and establishes it, and the evidence travels with the answer — so the person reading it can check your working instead of trusting you.
Occasionally the honest answer is not the one you wanted. When that happens you hear it from us first, with a clear account of what is actually wrong and what it would take to put right — a short list you can act on, well before the customer sees anything.
An honest answer has a shelf life. Your product changes with every release, and answers written last year quietly stop being true. Winnow keeps them current, so the next customer gets today’s position and you are never defending a document you have outgrown.
Not everything on one of these forms can be proved, and pretending otherwise is how the whole exercise lost its credibility. So we label every answer for what it honestly is.
Anything that can be established about the product you actually ship. The answer arrives with its evidence and the date it was confirmed, so the person reading it can satisfy themselves rather than take it on faith.
Everything that lives in a policy rather than in the product. Write it a single time and Winnow reuses it from then on, noting who approved it and when, clearly marked as a statement rather than a measurement.
Most vendors send back a wall of undifferentiated text and hope nobody pushes back. Saying plainly which answers are proof and which are policy makes the whole document easier to believe — including the parts you couldn’t prove.
For the answers we can establish, there are three levels of proof. Each is harder evidence than the last, and most tools stop at the first.
Start with what your build says about itself: the parts it was assembled from, how it was put together, how the service behind it is set up. Necessary, quick, and not remotely the same thing as proof — but it is as far as most tooling goes.
Records are often wrong in both directions. A component listed as faulty was repaired months ago without its version number changing; another looks fine but was never updated. We work out what is actually in the thing you ship and which of it anyone could reach — the difference between a frightening list and a real problem.
The strongest evidence there is. With your permission and on equipment you nominate, we test the claim rather than reason about it — attempt the tampered update and confirm it is refused, watch what the product genuinely sends. Results with a date on them that nobody has to take on trust.
Security companies have a habit of implying they cover everything. Here is a straight list of what we don’t do, so nobody finds out the awkward way:
What we do is narrow on purpose. Know what is genuinely true about the product you ship, put it in a form somebody else can check, and keep it that way as you release.
Simplifying the world, one boring-but-essential thing at a time.