Topic starter
16/09/2026 9:21 am
TL;DR: 75% of IT and security professionals believe AI adoption is outpacing their ability to vet third parties, while 87% expect to rely more on AI-driven capabilities and 82% think agentic AI will improve vetting speed and reliability, according to Drata. Point-in-time vendor review is becoming a weak control when vendor AI footprints change continuously.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “The Third-Party Problem: The Next Automation Frontier”.
By the numbers:
- 66% of professionals agree their TPRM process is time-consuming and creates procurement bottlenecks.
Key questions
A: Security teams should treat AI introduced by vendors as a dynamic supply chain risk, not a one-time procurement check.
Q: Why does point-in-time vendor review fail in AI-enabled supply chains?
A: Because the vendor changes faster than the review cycle.
Q: What are the warning signs that third-party assurance is too stale to trust?
A: Common signs include long gaps between reviews, heavy reliance on attestation without fresh evidence, and no trigger for material product changes.
Practitioner guidance
- Implement change-triggered vendor re-review Tie reassessment to material supplier changes such as new AI features, data-flow changes, model additions, or ownership changes instead of relying on annual cycles.
- Replace static questionnaires with continuous evidence Require living evidence, updated control attestations, and posture signals that can be refreshed when the vendor’s service changes.
- Map vendor AI features to data and trust boundaries Document where a supplier’s AI capabilities process customer data, influence decisions, or introduce new delegated access paths.
Bottom line: AI-enabled suppliers can change faster than annual vetting cycles, which turns static assurance into a lagging indicator.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/09/2026 9:21 am
Point-in-time third-party vetting is now a governance lag, not a control. Annual approval cycles were always a compromise, but AI has made them visibly obsolete because vendor capability can change without any new procurement event. The real failure is assuming that an old assurance file still describes the current service. Practitioners should treat approval dates as historical artefacts, not present-tense evidence.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations use trust centres or continuous monitoring for vendor assurance?
A: Use both, but only if the trust centre feeds an internal reassessment workflow. Supplier disclosure is useful when it triggers decisions, exceptions, and renewal gates. Without that connection, a trust centre is just another static artifact and continuous monitoring becomes an empty promise.
👉 Read our full editorial: AI-driven third-party vetting is replacing point-in-time reviews