Risky tech rankings: what the Q3 shifts mean for security teams

TL;DR: The number of vendors scored rose 8% to 8,771 and contributing vulnerabilities rose 4% to 44,365, while a few household-name vendors moved sharply upward in the ranking, according to Coalition’s Q3 2025 Risky Tech Ranking. Vulnerability exposure is becoming a purchasing and governance problem, not just a patching backlog.

Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Risky Tech Ranking: Q3 2025 Updates”.

By the numbers:

• The total number of vendors scored increased by 8%, from 8,145 in Q2 to 8,771 in Q3.
• The total number of contributing vulnerabilities increased by 4%, from 42,716 in Q2 to 44,365 in Q3.

Key questions

Q: How should security teams use vendor vulnerability rankings in procurement decisions?

A: Use them as one risk input, not as a substitute for architecture review or supplier assurance.

Q: Why do code injection flaws matter to IAM and NHI governance?

A: They matter because injected code often runs under a trusted application or pipeline identity.

Q: What are the warning signs that a third-party technology risk score is becoming outdated?

A: A score becomes less useful when it is treated as a one-time purchase checkbox rather than a live signal.

Practitioner guidance

• Re-score vendors that sit on sensitive paths Prioritise suppliers whose products authenticate users, process secrets, or mediate privileged operations, because their vulnerability profile changes your effective access-risk boundary.
• Fold exploitability into procurement reviews Use exploit-weighted rankings alongside functional and commercial criteria so purchasing decisions account for the likelihood that disclosed flaws will be weaponised.
• Reassess suppliers after sustained ranking movement Trigger a deeper review when a vendor repeatedly climbs the list, even if no incident has occurred, and verify whether compensating controls match the new exposure.

Bottom line: The article frames vendor vulnerability exposure as a governance problem, not only a patching problem, because disclosed flaws can change supplier trust assumptions before an incident occurs.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →