Loeb & Loeb, founded in 1909, is a multi-service law firm with nine offices in the US and Asia. Known for its long-term client relationships and emphasis on senior attorney involvement, Loeb & Loeb prides itself on coordinating client matters expertly, efficiently, and expeditiously.
For over 100 years, clients have entrusted Loeb & Loeb with complex deals, disputes, and the confidential information behind them. To protect that information, client contracts require the firm to vet the third-party technology providers it uses to store and transfer client data.
Brenda Albeno, Manager of Governance, Risk, and Compliance (GRC), and her colleague assess new providers and periodically review existing ones, overseeing a total of 200 vendors. As the firm increased its use of AI-enabled providers, assessments needed to cover both how vendors protected client data and how their AI systems used it, which required additional evidence and new evaluation criteria.
Brenda used Bitsight to send security questionnaires to vendors and request supporting evidence, including SOC 2 reports and ISO certifications. Gathering a complete set of responses and documents, however, often required Brenda’s follow-up to either collect missing attachments or reach vendors who hadn’t responded through the platform. And because SOC 2 reports required closer analysis, Brenda turned to another platform, Microsoft Copilot, for help evaluating the findings.
Loeb’s GRC team was responsible for reviewing vendor questionnaire responses, evaluating supporting documentation, and identifying potential security and compliance concerns. Findings requiring additional review or risk decisions were escalated to Wilson Ye, Chief Information Security Officer. The process frequently required multiple rounds of follow-up with vendors to obtain clarification or additional evidence.
The work didn’t end with the initial approval. Brenda’s team had to manually track reassessment deadlines on a compliance calendar, check vendor trust centers for updated reports, and chase vendors for missing documents to keep assessments current.
Brenda and Wilson knew automation could free them from chasing documents and enable them to focus on the actual evaluations. But the broader governance, risk, and compliance platforms they explored relied on questionnaire-led workflows that left much of the manual work with their team.
Loeb & Loeb was already using Conveyor to automate responses to clients’ security questionnaires. So when Brenda shared her frustrations about vendor reviews, the Conveyor team introduced her to Clear, its AI agent for third-party risk management. Clear could analyze vendors’ security evidence, recommend next steps, and help Brenda and Wilson make more informed vendor decisions.
“We needed more than a vendor’s answers. We needed evidence that showed how they actually protected our clients’ data.”
Brenda didn’t need a formal onboarding process to start using Clear. She could get into the platform and begin assessing vendors right away. As she used Clear, the Conveyor team refined the reports based on her feedback, making findings easier to review and act on.
Clear’s evidence-led approach now shapes the team’s daily workflow. Brenda’s team connected a shared email inbox to Clear so the agent can request missing documents, follow up with vendors, and gather evidence from vendor trust centers. Brenda says this has made reviews easier: she and her colleague no longer need to collect the evidence themselves and can focus on reviewing the findings.
Clear then analyzes SOC 2 reports alongside data processing agreements, security white papers, and other evidence to identify potential risks to client data, and Brenda reviews the findings in the same platform.
The agent ultimately produces a risk assessment report in its vendor portfolio view, highlighting security concerns and recommending which issues to address before signing a new contract. Wilson reviews the findings and recommendations in a single assessment document, then applies his knowledge of the firm’s security controls to determine what needs action. For Loeb & Loeb, this deeper analysis has already highlighted vendors that warrant closer review.
“Having everything in one report saves me from working through individual questions and answers. I can focus on the risks and recommendations.”
Brenda describes Clear’s guidance on an AI vendor as a turning point. Beyond what the team had already requested, Clear identified additional evidence to collect, including penetration test results. This helped her look beyond questionnaire answers to assess the vendor’s true security practices.
“Clear helped us understand what to look for with AI vendors. We now have a clear set of documents to examine and a way to dig into the evidence behind their answers.”
Clear’s agent also automatically checks vendor trust centers for updated documents and reruns reviews on a set schedule, flagging changes such as new certifications or breaches. Brenda’s team reviews the findings and supporting documents in Clear’s portfolio view, so they can respond to changes without manually checking each vendor or chasing updated reports.
Together, the analysis, recommendations, and portfolio give Brenda and Wilson a focused vendor review workflow without adopting a broader governance platform. Loeb & Loeb now more confidently protects client data and meets the firm’s security commitments to clients.
“Clear’s reports don’t just identify concerns. They tell us what to address before we sign the contract. Everything you need to review is right there at your fingertips.”
With Conveyor, Brenda and Wilson are getting a fuller picture of vendor risk while spending less time assembling the evidence. That shift is showing up in both the depth of their reviews and the time reclaimed.
Looking ahead, Wilson plans to build on the evidence Clear collects to guide the firm’s AI governance work, including alignment with standards such as ISO 42001.
