Risky tech rankings show vulnerability pressure is widening

At a glance

What this is: Coalition’s quarterly Risky Tech Ranking tracks vendors whose products were associated with exploitable vulnerabilities, and Q3 2025 showed broader vendor coverage and more contributing flaws.

Why it matters: It matters because technology procurement, third-party risk review, and vulnerability management all depend on understanding which products are accumulating exploitable exposure before it becomes an incident.

By the numbers:

• The total number of vendors scored increased by 8%, from 8,145 in Q2 to 8,771 in Q3.
• The total number of contributing vulnerabilities increased by 4%, from 42,716 in Q2 to 44,365 in Q3.
• In 2024, cyber criminals exploited more than 3,000 new vulnerabilities per month to carry out ransomware campaigns, steal sensitive data, or establish long-term access.

Context

Coalition’s Q3 2025 update is a ranking and risk signal, not a traditional breach report. The underlying issue is straightforward: organisations often buy technology before they have a defensible view of how much exploitable exposure that technology is accumulating over time.

The ranking tries to close that governance gap by converting public vulnerability data into a vendor-level risk measure. For identity and access teams, the point is not the score itself, but the procurement and third-party assurance questions the score should trigger when vendor software touches sensitive systems.

Key questions

Q: How should security teams use vendor vulnerability rankings in procurement decisions?

A: Use them as one risk input, not as a substitute for architecture review or supplier assurance. A vendor with repeated exploit exposure deserves closer scrutiny if its product sits on identity, secrets, or administrative paths. The key decision is whether the supplier’s risk profile changes the control burden you inherit after deployment.

Q: Why do code injection flaws matter to IAM and NHI governance?

A: They matter because injected code often runs under a trusted application or pipeline identity. That can expose API keys, tokens, certificates, and deployment privileges even when user authentication is strong. IAM and NHI teams should therefore govern the identities behind applications, not only the people who use them.

Q: What are the warning signs that a third-party technology risk score is becoming outdated?

A: A score becomes less useful when it is treated as a one-time purchase checkbox rather than a live signal. Repeated upward movement, new disclosure bursts, or expansion into critical workflows are signs the supplier review process is lagging behind the exposure profile.

Q: Should organisations prioritise exposed suppliers over lower-scoring vendors with wider deployment?

A: Yes, when the exposed supplier sits on sensitive access paths or handles credentials, because the blast radius can be greater than the raw score suggests. A lower-scoring vendor that is deeply embedded may still deserve attention, but exploitability should shape sequencing.

Technical breakdown

How exploit-weighted vendor rankings translate vulnerability volume into risk

Coalition’s ranking multiplies the number of vulnerabilities affecting a vendor’s products by the average exploit score to produce a comparative risk view. That approach matters because raw vulnerability counts alone do not tell teams which products are more likely to be weaponised. The method is useful as a triage signal, but it still depends on product scope, disclosure timing, and the quality of public vulnerability data. It is therefore a prioritisation tool, not proof of compromise or proof that every affected customer is exposed in the same way.

Practical implication: Use exploit-weighted rankings as one input to third-party risk and remediation prioritisation, not as a standalone verdict.

Why vendor risk scores matter to identity and access governance

Vendor vulnerability exposure becomes an IAM and NHI issue when third-party software sits on paths that authenticate users, process tokens, or mediate access to sensitive data. In those cases, exploitable software can become a route to credential theft, session abuse, or long-term persistence inside business systems. That is why procurement, security architecture, and access governance cannot stay separate. A product that looks acceptable in a buying decision may still widen the attack surface for identities, secrets, and downstream privileges once deployed. See the Service Account Security Guide.

Practical implication: Treat products that handle authentication, secrets, or privileged workflows as higher-assurance procurement candidates.

Why ranking movement is a control signal, not a final verdict

Quarterly movement in a ranking can reflect new disclosures, changing exploitability, or better visibility into the vendor’s product estate. It does not necessarily mean the underlying technology suddenly became worse or that every customer now faces the same risk. The useful control signal is trend direction: repeated upward movement should trigger closer review of exposure, compensating controls, and dependency concentration. Downward movement is not immunity either, because older vulnerable products can remain embedded in environments long after the headlines fade.

Practical implication: Investigate sustained upward movement as a cue to reassess compensating controls and supplier dependence.

Threat narrative

Attacker objective: The attacker aims to turn an exposed vendor weakness into durable access, data theft, or ransomware leverage across customer environments.

1. Entry occurs when threat actors exploit publicly disclosed vulnerabilities in vendor products before defenders can fully patch or replace them.
2. Escalation follows when those flaws are used to steal data, establish persistence, or reach adjacent systems that were trusted by the vulnerable product.
3. Impact is broader compromise of business systems, including ransomware, sensitive data theft, or long-term access for future malicious activity.

Breaches seen in the wild

• Commvault Metallic breach 2025: A nation-state actor exploited a Commvault zero-day in Azure and may have taken app secrets that open customers' Microsoft 365 tenants.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploit-weighted risk scoring is becoming a procurement control, not just a vulnerability metric. The article shows that teams are no longer evaluating vendors only on feature fit. They also need a defensible view of how often the vendor’s products appear in public exploit data, because that exposure changes third-party risk posture before any incident reaches the customer. Practitioners should treat vendor risk scoring as part of technology selection and ongoing supplier review.

Vendor vulnerability ranking creates a new kind of cloud and identity governance pressure. When products sit on authentication paths, secrets flows, or privileged administrative surfaces, their vulnerability profile becomes relevant to IAM and NHI governance as well as general security. That means third-party assurance has to extend beyond questionnaires to deployment context, because a vulnerable product can alter the trust boundary around service account security. Practitioners should map vendor exposure to the identities and privileges the product can reach.

Ranking movement is useful because it surfaces concentration risk, not because it predicts a breach. A vendor climbing the ranking may reflect newly disclosed flaws, higher exploitability, or simply better measurement. The governance mistake is to read it as a binary safe or unsafe label. The better response is to ask where that product is embedded, what credentials it touches, and whether compensating controls exist if exploitation occurs. Practitioners should use movement as a trigger for dependency review.

Supplier exposure debt: the accumulated governance risk created when organisations adopt products faster than they reassess the exploitability of those suppliers over time. This article shows why that debt matters. Once a vendor’s product estate keeps surfacing in public vulnerability data, the buyer inherits a standing obligation to re-evaluate trust assumptions, not just patch cycles. Practitioners should build recurring supplier-risk review into procurement and renewal decisions.

What this signals

Supplier exposure debt: security teams accumulate governance risk when they treat vendor vulnerability posture as static after procurement. The operational lesson is to re-evaluate suppliers on a recurring basis, especially where those products authenticate users, mediate privileged actions, or handle sensitive data.

Ranking data is most useful when it changes decisions about renewal, segmentation, and compensating controls. A vendor climbing the list should trigger a fresh review of where that product sits in the trust chain and whether the environment can tolerate its failure mode.

The most defensible use of a vendor-risk ranking is as a forcing function for cross-functional review. Procurement, identity, and security teams should align on which suppliers deserve deeper scrutiny before exposure becomes incident response.

For practitioners

• Re-score vendors that sit on sensitive paths Prioritise suppliers whose products authenticate users, process secrets, or mediate privileged operations, because their vulnerability profile changes your effective access-risk boundary.
• Fold exploitability into procurement reviews Use exploit-weighted rankings alongside functional and commercial criteria so purchasing decisions account for the likelihood that disclosed flaws will be weaponised.
• Reassess suppliers after sustained ranking movement Trigger a deeper review when a vendor repeatedly climbs the list, even if no incident has occurred, and verify whether compensating controls match the new exposure.
• Track vendor exposure around privileged workflows Inventory products that touch admin consoles, identity providers, token flows, or service accounts, then assign higher governance scrutiny to the suppliers behind them.

Key takeaways

• The article frames vendor vulnerability exposure as a governance problem, not only a patching problem, because disclosed flaws can change supplier trust assumptions before an incident occurs.
• Coalition reports 8,771 vendors scored and 44,365 contributing vulnerabilities in Q3 2025, showing that exposure data is expanding rather than stabilising.
• Security teams should use ranking movement to re-check suppliers that sit on identity, secrets, or privileged access paths, then tighten compensating controls where needed.

Related NHI Mgmt Group resources: Zero-Day and Exploited Vulnerabilities Guide · Threat Hunting Guide

Key terms

• Exploitability-Weighted Risk: Exploitability-weighted risk is a prioritisation method that combines severity with real-world attacker likelihood, asset criticality, and exposure. It is more useful than raw scoring because it helps teams focus on what can actually be abused first, not just what looks serious on paper.
• Supplier Exposure Debt: The governance risk that builds when organisations keep using third-party products whose exploitability profile is changing faster than their review process. It captures the lag between disclosure, reassessment, and compensating control decisions across procurement and operations.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps practitioners connect identity governance to the broader security programme they run across cloud, apps, and operations.