Topic starter
11/07/2026 1:57 pm
TL;DR: The shift from periodic third-party assessments to continuous, threat-informed supply chain security took center stage at the Odyssey 2026 conference in Miami, with nearly 300 CISOs and risk leaders discussing real-time operations, nation-state pressure, and automation, according to SecurityScorecard. The operating model is moving from checkbox review toward evidence-driven vendor oversight, where timing and context matter more than annual scorecards.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “Odyssey 2026 Recap: Building Continuous Supply Chain Resilience in an Era of Persistent Threats”.
By the numbers:
- 90% of companies rely on software and services from roughly 150 third-party providers.
Key questions
Q: What breaks when third-party risk management depends on annual reviews?
A: Annual reviews create a blind window between supplier risk changes and governance action.
Q: Why does supplier access create downstream security risk even when contracts are in place?
A: Contracts describe expectations, but they do not prevent a compromised supplier account, integration token, or support workflow from being used against downstream systems.
Q: What are the signs that third-party risk management is not working well enough?
A: A weak program usually shows up as duplicate manual reviews, slow follow-up on vendor issues, and mismatches between questionnaire answers and external risk signals.
Practitioner guidance
- Implement continuous vendor evidence collection Track supplier controls, access, and exposure on an ongoing basis instead of waiting for annual reassessment cycles.
- Map shared-dependency concentration risk Identify which providers support multiple business units, systems, or regions so you can see where a single supplier issue could affect several environments at once.
- Tie threat intelligence to vendor review cadence Increase review frequency when intelligence shows active targeting, exploit activity, or sector-specific campaigns against a supplier or its technology stack.
Bottom line: Periodic supplier questionnaires are no longer enough when vendor ecosystems change faster than assessment cycles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:08 pm
Continuous supply chain monitoring is now an access-governance problem, not just a procurement problem. Once suppliers hold credentials, tokens, APIs, or privileged support channels, their risk posture becomes part of the organisation’s access perimeter. Annual questionnaires cannot govern delegated trust that changes between review cycles. Practitioners should treat supplier access as a living identity surface, not a static approval record.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise the suppliers with the highest downstream impact first?
A: Yes. Prioritising by downstream impact is more defensible than treating all suppliers equally, because concentration risk means one provider can affect many systems at once. Focus first on vendors with production access, sensitive data exposure, critical business services, or shared dependencies across multiple teams. That sequencing reduces the biggest blast radius before attention is spent on low-consequence suppliers.
👉 Read our full editorial: Continuous supply chain risk operations are replacing periodic assessments