Security questions to ask before you hire a web or app vendor

Before you hire a company to build your website or app, ask five things: which common vulnerabilities they design out and how they check, who applies updates after launch, where admin accounts and keys live, how their own staff use AI tools with your code and data, and what happens in the first hours of an incident. Then write the answers into the contract. IPA publishes free guides for every one of these, so the questions do not depend on your own security expertise.

Why the vendor is part of your risk

Each year IPA, Japan's information-technology promotion agency, ranks the security threats to organizations with a selection panel of about 250 researchers and practitioners. In the 2026 edition, published on January 29, ransomware is first. Attacks that target the supply chain or contractors are second, on the list for the eighth year in a row. Risks around the use of AI entered at third, new this year. Exploiting system vulnerabilities is fourth.

A web or app vendor touches three of those four. It writes the code, it often runs the server, and it now uses AI tools while doing both. Asking good questions before you sign costs you an hour. Asking them after an incident costs a lot more.

Which vulnerabilities do you design out, and how do you check?

IPA's How to Secure Your Web Site is the standard Japanese reference. The revised 7th edition runs to 115 pages. Its first chapter covers 11 kinds of vulnerability in web applications, including SQL injection, OS command injection and cross-site scripting, and the fixes that remove the cause. A separate implementation checklist comes as an Excel file.

A useful question is plain: will you fill in that checklist, or one like it, for our project, and hand it over at delivery? A vendor that already works this way will say yes quickly.

IPA also publishes a Web Health Check specification with 13 diagnostic items. It warns that a clean result is not a declaration of safety, because the check uses a narrow set of patterns. If a vendor offers a scan as proof the site is secure, that warning is worth quoting back.

Who applies updates after launch?

The second chapter of the same guide covers operation: web server management, password handling and five more items. Operation tends to fall between the cracks, because the build contract often ends at launch.

Ask who updates the CMS, plugins, libraries and server software, how often, and under which contract. Ask how they hear about new vulnerabilities in what they used. If the answer is that you will be told when something breaks, the maintenance scope needs writing down.

Where do the admin accounts and keys live?

Ask who holds the administrator accounts for the server, the domain, the CMS and any cloud services, whether two-step verification is on, and whether any password is shared between people. Ask what happens to access when one of their staff leaves the project.

The answers should put the owner accounts in your company's name, with the vendor invited as a user. The same logic applies to app store accounts, which we cover in putting your app on the App Store under your own company name.

How does your team use AI tools with our code and data?

With AI risk now third on IPA's list, this question belongs in every vendor conversation. Ask which AI tools their developers and designers use, whether your code, documents or customer data go into them, and whether training on inputs is off for the accounts they use.

The same thinking applies to your own staff. If your staff use AI, the AI Guidelines for Business are about you covers the user side.

What happens in the first hours of an incident?

Ask who the vendor contacts, how fast, and at what hours. Ask whether they keep access and operation logs and for how long, because without logs nobody can say what was taken.

IPA's Information Security Guidelines for SMEs went to version 4.0 on September 30, 2026. It ships with a short incident response guide for smaller companies, and its five minute self-assessment now includes running your website securely. Version 4.0 is also aligned with the security rating scheme for supply chains that METI and the Cabinet Secretariat are preparing, so expect larger customers to start asking their suppliers the same kind of questions.

Write the answers into the contract

Spoken answers fade. IPA's model contract for information systems, second edition, was published on December 22, 2020 together with a guideline on writing security specifications for development contracts. You do not need to adopt either word for word. Borrow the habit: an annex that lists the checklist to be completed at delivery, the maintenance scope and update interval, account ownership, the vendor's rules for AI tools, and incident contact and log retention. The legal checks to settle with a vendor before launch are a separate list, in seven compliance checks before launch.

A vendor that is confident in its work usually prefers this. It turns a vague worry on your side into a list it can deliver against.