Topic starter
24/10/2026 8:53 pm
TL;DR: Vendor coverage rose 8% to 8,771 and contributing vulnerabilities rose 4% to 44,365 in Coalition’s Q3 2025 Risky Tech Ranking, according to Coalition. Supplier risk is now shifting fast enough that procurement and governance reviews have to track ranking movement, not just patch counts.
Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Risky Tech Ranking: Q3 2025 Updates”.
By the numbers:
- The total number of vendors scored increased by 8%, from 8,145 in Q2 to 8,771 in Q3.
- The total number of contributing vulnerabilities increased by 4%, from 42,716 in Q2 to 44,365 in Q3.
Key questions
Q: Why do code injection flaws matter to IAM and NHI governance?
A: They matter because injected code often runs under a trusted application or pipeline identity.
Q: What are the warning signs that a third-party technology risk score is becoming outdated?
A: A score becomes less useful when it is treated as a one-time purchase checkbox rather than a live signal.
Q: How should security teams use vendor vulnerability rankings in procurement decisions?
A: Use them as one risk input, not as a substitute for architecture review or supplier assurance.
Practitioner guidance
- Re-score vendors that sit on sensitive paths Prioritise suppliers whose products authenticate users, process secrets, or mediate privileged operations, because their vulnerability profile changes your effective access-risk boundary.
- Fold exploitability into procurement reviews Use exploit-weighted rankings alongside functional and commercial criteria so purchasing decisions account for the likelihood that disclosed flaws will be weaponised.
- Reassess suppliers after sustained ranking movement Trigger a deeper review when a vendor repeatedly climbs the list, even if no incident has occurred, and verify whether compensating controls match the new exposure.
Bottom line: The article frames vendor vulnerability exposure as a governance problem, not only a patching problem, because disclosed flaws can change supplier trust assumptions before an incident occurs.
Glossary terms: Exploitability-Weighted Risk, Supplier Exposure Debt, Compensating Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Exploit-weighted risk scoring is becoming a procurement control, not just a vulnerability metric. The article shows that teams are no longer evaluating vendors only on feature fit. They also need a defensible view of how often the vendor’s products appear in public exploit data, because that exposure changes third-party risk posture before any incident reaches the customer. Practitioners should treat vendor risk scoring as part of technology selection and ongoing supplier review.
A question worth separating out:
Q: Should organisations prioritise exposed suppliers over lower-scoring vendors with wider deployment?
A: Yes, when the exposed supplier sits on sensitive access paths or handles credentials, because the blast radius can be greater than the raw score suggests. A lower-scoring vendor that is deeply embedded may still deserve attention, but exploitability should shape sequencing.
👉 Read our full editorial: Risky tech rankings show vulnerability pressure is widening
This post was modified 6 days ago by NHI Mgmt Group