Topic starter
12/07/2026 12:19 pm
TL;DR: Annual questionnaires and static attestations are failing to reflect real third-party exposure, while SecurityScorecard cites 90% of practitioners lacking confidence in their third-party risk programs despite 85% calling them effective. The operational shift is away from box-ticking and toward continuous discovery, concentration-risk analysis, and SOC-linked response.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “RSAC 2026 Talk: Transforming Third-Party Risk Management From Compliance Checkboxes to Security Resilience”.
By the numbers:
- 90% of security practitioners lack confidence in their third-party risk programs, according to SecurityScorecard.
- 85% of practitioners still call those same third-party risk programs effective, according to SecurityScorecard.
Key questions
A: When third-party risk management depends only on questionnaires and periodic assessments, organisations can believe a vendor is safe even after its posture has changed.
Q: Why do vendor and contractor relationships increase breach risk in enterprise environments?
A: Vendor relationships increase risk because external parties are often granted privileged access to multiple customer environments while holding sensitive data outside the organisation’s direct control.
Q: What are the signs that third-party risk management is not working well enough?
A: A weak program usually shows up as duplicate manual reviews, slow follow-up on vendor issues, and mismatches between questionnaire answers and external risk signals.
Practitioner guidance
- Build a live third-party inventory Continuously discover vendors, SaaS tools, and fourth-party dependencies, then attach a business owner and data-access classification to each relationship.
- Replace annual attestations with continuous monitoring Use technical evidence such as leaked credentials, open ports, cloud exposure, and change events to validate supplier posture as it changes.
- Map concentration risk across shared dependencies Identify where multiple critical suppliers rely on the same cloud provider, integration layer, or authentication service, then rank the shared failure paths.
Bottom line: Third-party risk programmes now fail most visibly when they rely on static attestations to describe a live and changing access environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
Continuous monitoring, not annual attestation, is now the baseline for third-party governance. Static questionnaires can record intent, but they cannot show whether a supplier still has exposed services, leaked credentials, or changing trust relationships. That creates a governance gap between documented compliance and actual risk, especially where access is mediated by non-human identities and machine credentials. Practitioners should treat supplier assurance as an always-on control problem, not a paperwork cycle.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams respond when a critical supplier’s exposure changes?
A: They should immediately reassess the supplier’s access scope, related dependencies, and whether monitoring alerts require containment or escalation. The priority is to understand what the supplier can reach, what the supplier shares with others, and how quickly the organisation can reduce exposure if the threat signal proves credible. Response should be tied to business criticality, not just ticket queue order.
👉 Read our full editorial: Third-party risk management is shifting from compliance to monitoring