Risk management statistics show cyber, third-party, and AI risk rising

At a glance

What this is: Secureframe’s risk statistics compile 50+ findings showing cyber exposure, AI risk, third-party dependence, and insider risk are all rising across enterprise risk programmes.

Why it matters: IAM, NHI, and governance teams need to treat risk management as a control-orchestration problem, because the same visibility, ownership, and accountability gaps that weaken enterprise risk also weaken identity and access governance.

By the numbers:

• 80% of enterprise risk management decision-makers say volatility is either increasing or staying the same.
• Nearly 75% of enterprises experienced at least one critical risk event in the past year.
• Only 35% of financial leaders report having comprehensive ERM processes in place.
• 95% of organizations now have visibility into at least tier-one supplier risks.

Context

Risk management is no longer just a finance or compliance function. The article’s statistics show that cyber risk, AI risk, third-party exposure, and insider risk are all competing for attention at the same time, which makes fragmented oversight harder to sustain.

For identity and security teams, the main issue is not a lack of controls in isolation. It is whether risk ownership, control mapping, and reporting are strong enough to connect identity decisions, supplier exposure, and incident response into one operating model.

Key questions

Q: Why do browser extensions matter to identity and access governance?

A: Browser extensions matter because they are delegated software identities operating inside a user trust context. They can influence what the user sees, what they download, and what code reaches the endpoint. That makes them part of the access plane, especially when browser activity is tied to business systems and sensitive workflows.

Q: Why does third-party risk often become an access control problem?

A: Because vendors, subcontractors, and service providers frequently interact with internal systems through credentials, tokens, shared platforms, or delegated permissions. If those access paths are not lifecycle-managed, the risk is no longer confined to procurement or legal terms. It becomes an identity governance problem, especially when offboarding, rotation, and authorisation reviews are inconsistent across supplier tiers.

Q: What are the warning signs that an ERM programme is too fragmented to be effective?

A: Common signs include unclear ownership for major risks, poor linkage between controls and risk records, limited supplier visibility beyond tier one, and reporting that does not reflect recent critical events. When risk data lives in separate tools or teams, the organisation can look well governed on paper while remaining operationally exposed.

Q: Should organisations prioritise cyber risk, AI risk, or third-party risk first?

A: They should prioritise the risks that share the same control surfaces. In practice, that often means starting with cyber and third-party exposure because both commonly depend on identity, access, and offboarding discipline. AI risk should be added at the same time where AI systems can influence decisions, inherit privileges, or accelerate phishing and fraud.

Technical breakdown

Why cyber risk now dominates enterprise risk discussions

The article shows cyber risk has moved from a specialist security topic to a board-level enterprise concern. That matters because cyber risk is now being assessed alongside financial, regulatory, and AI risk, which changes how organisations prioritise mitigation. In practice, this shifts the conversation from isolated control gaps to risk aggregation across systems, suppliers, and business units. When cyber risk repeatedly appears at the top of executive surveys, it usually means existing programme boundaries no longer match the real attack surface.

Practical implication: Practitioners should align cyber, identity, and GRC reporting so risk decisions reflect combined exposure, not siloed control views.

How third-party risk becomes an identity governance problem

Third-party risk is not only about supplier contracts or security questionnaires. It becomes an identity governance problem when vendors, service accounts, delegated access, and shared workflows create paths into sensitive systems. The statistics about limited visibility into lower-tier suppliers show why ownership matters: many organisations can name their primary suppliers, but they cannot always trace who else can act on their behalf. That is where NHI governance and access lifecycle controls start to matter.

Practical implication: Map third-party access, especially service accounts and delegated permissions, to the same governance standard used for internal identities.

Why AI changes the risk management model rather than just the risk mix

AI affects risk management in two directions at once. It increases the scale and speed of threats such as social engineering and data misuse, while also becoming a tool for anomaly detection and automated assessment. That dual role means organisations cannot treat AI as a separate risk column. They need a model that governs AI-enabled threats, AI-assisted controls, and the data and access paths those systems rely on. For identity teams, the key question is which AI systems can request, inherit, or amplify access.

Practical implication: Put AI use cases, data access, and delegated privileges into the same control review cycle as other high-risk systems.

NHI Mgmt Group analysis

Enterprise risk is becoming an identity and access governance issue, not just a reporting problem. The article’s statistics point to a pattern where cyber, third-party, insider, and AI risk all depend on who can access what, when, and under whose authority. Once that happens, risk management quality is determined by identity lifecycle discipline as much as by policy volume. The practitioner conclusion is that IAM, IGA, and PAM data must feed the risk function directly.

Third-party exposure is the clearest place where risk ownership breaks down. Supplier risk becomes harder to govern when access paths, delegated trust, and offboarding are not tracked with the same discipline as procurement contracts. The named concept here is delegated trust gap: the difference between knowing a third party exists and knowing what authority it still retains inside your environment. The practitioner conclusion is to govern supplier access as an identity lifecycle issue.

AI risk is now forcing organisations to manage both attack acceleration and control acceleration. The article shows that organisations are responding to AI threats with analytics, specialised tooling, and adapted compliance processes, but that is only part of the picture. AI systems themselves can become risk amplifiers when they inherit access or influence decisions without governance. The practitioner conclusion is to treat AI risk as an access and accountability problem, not only a model-risk issue.

Risk programmes fail when they cannot turn exposure into controlled action. Several figures in the article point to weak maturity, limited strategic value, and poor cross-functional visibility. That is the real governance gap: risks are often known, but not translated into enforceable control ownership. The practitioner conclusion is to connect risk registers to identity, supplier, and control evidence so response is operational rather than symbolic.

What this signals

Risk programmes are now only as strong as their identity and access evidence. The article’s broader message is that enterprise risk cannot be governed effectively when service accounts, vendor access, and privileged workflows sit outside the risk register. For identity teams, that means control assurance has to flow both ways: from IAM into GRC and from GRC back into access governance.

Delegated trust is becoming a more visible governance failure mode. The challenge is not simply that third parties are risky, but that their authority often persists after the business no longer thinks about them. Once access and offboarding are decoupled from supplier oversight, the organisation loses the ability to prove control over external pathways into sensitive systems.

AI will keep widening the gap between known risk and controlled risk unless ownership is explicit. Organisations are already using analytics and assessment tooling, but those capabilities do not remove the need for clear decision rights. The programme implication is that AI risk must be tied to the same accountability structure that governs identities, suppliers, and privileged access.

For practitioners

• Build a cross-functional risk-to-control map Link the major enterprise risks you track to specific owners, identity controls, supplier controls, and response workflows so risk data can drive action rather than remain a reporting artifact.
• Treat third-party access as lifecycle governance Inventory vendor accounts, delegated permissions, and service identities alongside contract reviews so offboarding, rotation, and revocation are part of third-party risk management.
• Separate AI-enabled threats from AI-enabled controls Record where AI increases risk exposure and where it improves detection or assessment, then assign clear control owners for each use case.
• Review board visibility against critical-event exposure Test whether board reporting actually reflects the number and type of critical events, because weak visibility often signals that the risk programme is not connected to operational controls.

Key takeaways

• The article shows that cyber, third-party, insider, and AI risks are converging into one governance challenge rather than separate workstreams.
• The scale problem is not theoretical: many respondents report rising volatility, recurring critical events, and weak maturity in core ERM processes.
• The practical fix is tighter linkage between risk registers, identity controls, supplier access, and named ownership for response.

Key terms

• Enterprise Risk: Enterprise risk is the potential for business harm caused by weaknesses in governance, control failures, or unmanaged exposure across systems and processes. In identity security, it includes excessive access, delayed approvals, weak oversight, and control gaps that can affect compliance, operations, and sensitive data protection.
• Third Party Risk: Third party risk is the chance that an outside organization, supplier, contractor, or service provider will create harm for your business. It includes security, privacy, operational, legal, and compliance exposure caused by access to data, systems, or processes. In identity terms, it often arises from shared credentials, integrations, and delegated trust.
• Insider Risk Management: Insider Risk Management is the practice of detecting, investigating, and reducing harm caused by legitimate identities misusing access. It covers human error, malicious insiders, compromised accounts, and increasingly AI-driven actors that can move sensitive data without breaking perimeter controls.
• Risk Register: A risk register is a structured record of identified risks, their likelihood, impact, owners, and response plans. In identity-heavy environments, it should include the identities and access paths that create the risk, not just the business system name, so the register can drive real remediation.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect access governance, lifecycle control, and operational risk management.