Home / Articles / Send an agent, not a spreadsheet / Versions / v1.1.0
Send an agent, not a spreadsheet: what changed in v1.1.0
From v1.0.0 (2026-10-05, 8616d8285) to v1.1.0 (2026-10-05, f0b5b72b4), paragraph by paragraph.
0 paragraphs added, 0 removed, 1 changed in place, 85 unchanged. About 8 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
16 unchanged paragraphs, under In short, The form that never connected to anything
I want to be fair to the people who built this, because itthe form was notthe stupidity.best that could be done at the time. Due diligence was a form because the alternative did not exist. Reading a vendor's code was impossible for a buyer, politically and practically. Reading a vendor's practices meant interviews, which do not scale and which the vendor prepares for. The data about what actually happened in a vendor's repositories, who changed what, what was reviewed, what broke and why, was not available to the vendor itself in any usable shape, let alone to a buyer. So the industry built the thing it could build, a questionnaire, and then a market of tools that help vendors answer questionnaires faster from their own documents: Vanta's product "combs through your knowledge base of security documentation and previous questionnaires" and answers eighty percent or more of the questions; Conveyor reports eighty-five percent of answers "going out unedited". That is where the automation stopped: at the form, not at the facts behind it. The other kind of tool, the outside-in rating, scores DNS health, patching cadence and IP reputation from the internet, which is a view of the perimeter and says nothing about what is inside.
69 unchanged paragraphs, under What changed, Questions where the non-answer is also an answer, Risk-based, not pure…