The reflex is to keep them apart. Security questionnaires go to the security team, testimonials go on the website, and mixing the two feels like showing up to a compliance review with a brochure. Most vendors follow that instinct, and most of the time they are right to.
But the instinct is doing two different jobs at once, and only one of them is correct. It is right that a customer quote can never answer a control question — no amount of enthusiasm substitutes for an encryption standard or a retention period. It is wrong that proof has no place in the document, because a meaningful share of what a reviewer is deciding is not a control question at all. It is a judgment about whether your answers describe what actually happens.
That judgment is exactly what a testimonial addresses, and nothing else in your response does.
What a security reviewer is actually deciding
Read a completed questionnaire from the reviewer's side. Almost every answer is a self-assertion. You say you encrypt at rest. You say you notify within 24 hours. You say access is reviewed quarterly. A certification raises confidence that some of those assertions were checked at some point by somebody, which is why certifications carry weight — but the reviewer still holds three questions your answers do not touch:
Does the process work when it is needed? A documented incident response plan and an incident response plan that functioned at 2am are different objects, and the questionnaire cannot tell them apart.
Will working with this vendor be painful? The reviewer is not only assessing risk, they are predicting their own workload — how many follow-ups, how much chasing, whether the vendor's security contact answers.
Has anyone like us already accepted this? Risk reviewers, like everyone else, find a decision easier when a peer has made it first, particularly in a regulated sector.
None of those can be answered with a control. All three can be answered with a sentence from a customer who has been through it.
Rule one: never place a testimonial where a control answer belongs
This is the rule that makes everything else possible, so it comes first.
If the questionnaire asks "Do you perform annual penetration testing," the answer is yes or no, the evidence is the report or the summary letter, and there is no place for a quote. A vendor who answers a control question with a customer's opinion reads as a vendor who cannot answer it, and the reviewer will now examine everything else more carefully. You have not added proof; you have added suspicion.
Every use of a testimonial described below sits outside the answer fields — in the cover note, in an appendix, in a reference section, or in the conversation around the document. Keep that boundary absolute and the rest of this works.
Slot one: the cover note, with one operational quote
Most questionnaires are returned with a short covering message. That message is usually wasted on pleasantries.
Use it for one sentence of context and one short quote from a customer in a similar regulatory position, speaking about the security relationship rather than the product:
"Their security team answered our follow-ups the same day, including the two that needed a document they had to write. Review closed in eleven days, which is the fastest we have had." — [Name], [Title], [Company]
That quote does not claim a control. It predicts the reviewer's own experience, which is the thing they cannot get from the document and are quietly wondering about. It is the same principle behind putting proof beside a specific objection on a localized landing page: the evidence has to answer the question actually in the reader's head.
Keep it to one. Two quotes in a cover note turns a professional handover into a pitch.
Slot two: an appendix of named customers in the same regulatory category
Behind the completed questionnaire, add a short appendix — half a page — listing customers who have completed a comparable review, grouped by what makes them comparable.
The grouping is the whole value. "Fourteen customers" means little. "Four customers subject to DORA, three US healthcare providers operating under HIPAA, two in scope for PCI DSS" tells a reviewer that people with their exact obligations examined your answers and proceeded. Where you have permission to name companies, name them. Where you do not, describe them precisely by sector, size, and regime, which still carries most of the signal.
If a listed customer has agreed to a one-line quote about the review process itself, include it under their entry. One line each, no more. This appendix is a density exercise, not a testimonial page.
Be careful about what the appendix implies. Listing a customer as having "passed" your security review is a claim about them, and some buyers consider their own vendor approvals confidential. Get explicit permission for this specific use, not general marketing permission — the approval workflow for quote sign-off applies here with a stricter standard, because the person approving needs to be someone who can speak for their security function, not their marketing one.
Slot three: the incident question, answered with evidence instead of a plan
Nearly every questionnaire asks about incident response, and nearly every vendor answers with a description of a plan. The reviewer has read forty of those and discounts all of them, because a plan is free to write.
Answer the control question normally — the notification window, the escalation path, the postmortem commitment. Then, if you have one, attach a customer statement describing a real incident or a real test:
"There was a degradation in March that touched our environment. We got the first notification before our own monitoring alerted, a written timeline within two days, and the fix confirmed in the next release. Nothing about it surprised us." — [Name], [Title], [Company]
This is the single most valuable testimonial you can hold as a B2B vendor, and almost nobody asks for it, because asking means reopening a bad day with a customer. Ask anyway — and ask shortly after the postmortem, while the customer's impression of how you handled it is still specific. A customer who was treated well during an incident is often more willing to say so than one who has simply had an uneventful year, which is the reasoning behind collecting a testimonial from a customer who passed a security review because of your tool.
Place it as a labeled attachment, never inside the answer box.
Slot four: the reference call, prepared rather than improvised
For larger deals, the review ends with a reference call, and vendors tend to treat it as a formality — pick a happy customer, make the introduction, hope it goes well.
Prepare it like a document. Choose the reference on regulatory similarity rather than enthusiasm: a delighted customer in an unregulated industry is worth less here than a moderately satisfied one who has been through the same audit regime. Brief them honestly on what the reviewer will likely ask — incident history, support responsiveness, whether any commitments slipped. And ask, after the call, whether they would be willing to put one line of what they said in writing, so the next review gets an artifact instead of another scheduling exercise.
Over a year this converts a repeated favor into a small library of sector-specific written proof, which is what you actually want. Asking one customer for six reference calls exhausts the relationship; asking once and reusing the sentence does not.
What to leave out
Testimonials about ease of use, onboarding speed, or value for money. They are irrelevant to the reader and signal that you did not understand the audience. This is the most common mistake, and it is usually the result of pasting from an existing testimonial library without filtering.
Anonymous quotes. In a security context, an unattributed testimonial is worth less than no testimonial. If the customer will not be named, describe them precisely — "a European retail bank, 4,000 employees" — and skip the quotation marks. Unattributed praise looks like a testimonial nobody can verify, which in this room is worse than silence.
Anything implying a customer endorses your security posture as adequate for a third party. A customer can describe their own experience. They cannot certify you to somebody else, and a quote that sounds like they are trying to will make a careful reviewer wonder who wrote it.
Volume. Three well-chosen pieces of proof across a 200-question response is the right density. Ten looks like a vendor compensating for thin answers.
The one-paragraph version
Keep testimonials out of every answer field. Use one operational quote in the cover note about what working with your security team is like, a short appendix of comparable customers grouped by regulatory regime, one incident-handling quote attached to the incident response section, and a deliberately chosen reference who is asked afterward to write down what they said. Everything else belongs on the website.
A security questionnaire is a document full of claims you make about yourself. The small amount of space where somebody else speaks is worth more than its length suggests — which is why it has to be spent on the questions the questionnaire cannot ask.