You didn't renew a contract. You hired someone.

Your team just renewed a software contract. Same vendor, same price, same security questionnaire as last year. Approved in a week.

What nobody noticed is that the product changed while you weren't looking. It now has an agent. It can draft, send, update and decide. It can reach into the other systems you connected to it years ago. And it is acting in your company's name.

You didn't renew a tool. You hired a contractor. And you skipped the interview.

Expect this at more and more of your renewals. Not because vendors are careless. Most of these features are good, and customers asked for them. It is happening because the way companies approve vendors was built for a world where software stored your data. It was never built for software that acts.

Look at what the questionnaire asks. Where is the data stored? Is it encrypted? Which certifications do you hold? Those are questions for a filing cabinet. The vendor just walked in with a staff badge.

Here is our view. Every software renewal is now a hiring decision, and it should be reviewed like one.

That means three questions at every renewal, asked by the business owner, not buried in a security form:

• What can it do on its own in our company, and is that switched on by default?
• Who at the vendor can change how it behaves, and will we be told?
• If it gets something wrong, where is the record, and can we get it without asking the vendor?

If the vendor cannot answer, that is not a failed questionnaire. That is a candidate who would not tell you what they plan to do on day one.

What we would do on Monday: take your ten biggest software vendors. Ask your team which of them can now act on their own inside your company. If nobody can answer with confidence, you have found your next audit finding before the auditor does.