Third-party cyber risk: what is changing for compliance teams?

TL;DR: 62% of organizations are seeing increased regulatory scrutiny across vendor ecosystems, while only 22% of CISOs feel fully prepared to meet evolving compliance requirements, according to Panorays. The gap shows that third-party risk programmes now fail operationally when they cannot produce continuous oversight, traceable evidence, and accountable governance.

Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Regulatory Pressure Is Rising: Why Most CISOs Aren’t Fully Prepared”.

By the numbers:

• 62% of organizations report a rise in regulatory scrutiny related to their vendor ecosystems.

Key questions

Q: What breaks when third-party risk management stays point-in-time?

A: Point-in-time TPRM misses posture changes that happen after the review is complete, which means the approval record can become stale almost immediately.

Q: Why do regulators care so much about vendor ecosystems now?

A: Because suppliers can create systemic exposure across multiple organisations and sectors, and one weak control can cascade far beyond the original relationship.

Q: What are the warning signs that human-in-the-loop governance is failing?

A: Watch for unusually fast approvals, repeated acceptance of similar requests, rising auto-approve behaviour, and reviewers missing context that should matter for high-impact decisions.

Practitioner guidance

• Strengthen third-party identity inventory Map every vendor account, API credential, delegated login, and support entitlement to a named owner and business purpose.
• Replace annual reviews with continuous monitoring Track changes in vendor access scope, hosting, subprocessors, and control posture as ongoing events rather than calendar tasks.
• Unify evidence across risk and IAM records Join procurement, legal, security, and identity records so each third-party decision can be reconstructed during audit or incident review.

Bottom line: Rising regulatory scrutiny is exposing a control gap between how organisations manage third parties and how confidently they can prove those controls work.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →