Secureframe's Questionnaire Automation uses AI and your Knowledge Base to automatically generate answers to security questionnaire questions. In most cases, the automation handles the majority of a questionnaire — but occasionally some questions will be left blank after processing.

This article explains why that happens, how to tell if it's expected, and what you can do to improve coverage over time.

When Questionnaire Automation processes a question, it searches your:

If the system cannot find relevant content that confidently matches the question being asked, it will intentionally leave the answer blank rather than guess. This is by design: the automation is built to prioritize accuracy over completeness.

A blank answer means: "We didn't find enough in your Knowledge Base or policies to answer this confidently."

It does not mean the feature is broken.

If your organization hasn't completed and verified many questionnaires yet, the Knowledge Base may not have entries that closely match the question's phrasing. Coverage improves automatically as you verify and submit more questionnaires.

The automation pulls from policies stored in Secureframe. If a policy (e.g., an Incident Response Policy or Vendor Management Policy) hasn't been uploaded and approved, the system won't have content to draw from for related questions.

Questions that ask for very specific details (e.g., "After how many hours are clients notified of a breach?") or that combine multiple sub-questions in one sentence are harder to match automatically. These often require a human answer the first time and will be learned for future runs once added to the Knowledge Base.

Some questionnaires include conditional follow-up questions — for example:

"Is the Firm utilizing a managed detection and response (MDR) solution?" (Yes/No)
​"If applicable, what primary MDR solution is in use?"

Questionnaire Automation treats every question independently. It's possible for a follow-up question to be answered if its phrasing matches existing Knowledge Base content, while the parent Yes/No question is left blank if the binary phrasing doesn't have a direct match. If you see this pattern, manually fill in the parent answer during the verification step — it will be saved to your Knowledge Base and auto-filled in future runs.

The more you use and verify questionnaires, the better the automation gets. Here are specific steps to maximize coverage:

Make sure these key policies are uploaded and in Approved status in Secureframe:

The automation draws directly from policy text — the more approved policies you have, the more questions it can answer without prior Knowledge Base entries.

The first time a unique question appears across your questionnaires, the automation may not be able to answer it. Answer it manually during the verification step and verify it — this adds it to your Knowledge Base so it's auto-filled next time.

Questions that require specific operational details (breach notification timelines, device types in use, specific security tools) should be answered manually and saved to the Knowledge Base with the correct factual detail. These types of answers typically don't exist in policy documents in an easily searchable form.

After Questionnaire Automation runs, you'll review all questions in the Verify stage. For any questions that were left blank:

Once verified and submitted, those answers are saved to your Knowledge Base and will be used automatically the next time a similar question appears.

If a large portion of questions are left blank, or if questions that your Knowledge Base clearly should cover are being skipped, contact Secureframe Support. Include:

Our team can review the automation run and help identify any coverage gaps.