Notifications
Clear all
Topic starter
10/07/2026 9:19 pm
TL;DR: RSAC 2026 exposed a widening gap between manual third-party risk management and how supply chain risk actually materialises, according to SecurityScorecard, while its TITAN AI launch claims up to 95% less manual effort and up to 75% fewer supply chain breaches according to the company. Periodic questionnaires are no longer a credible operating model when exposure, intelligence, and remediation need to move together.
NHIMG editorial — based on content published by SecurityScorecard: RSAC 2026 analysis of TITAN AI and continuous third-party risk management
By the numbers:
- The platform will reduce manual effort by up to 95% while helping organizations achieve up to 75% fewer supply chain breaches.
Questions worth separating out
Q: What breaks when third-party risk management relies on annual questionnaires?
A: Annual questionnaires break because they measure vendor posture at a point in time, while third-party exposure changes continuously through new integrations, delegated access, secrets, and subcontractors.
Q: Why do third-party access paths increase identity risk across enterprise programmes?
A: Third-party access paths increase identity risk because they often rely on tokens, OAuth grants, API keys, and service accounts that sit outside the normal employee lifecycle.
Q: What do security teams get wrong about supply chain risk scoring?
A: Security teams often treat all findings as equally urgent, which creates noise and slows action.
Practitioner guidance
- Inventory third-party access paths end to end Build a live register of vendor accounts, OAuth grants, API keys, service accounts, and delegated access tied to each supplier relationship.
- Tie remediation to active threat signals Use threat intelligence to prioritise which vendors and integrations get immediate review, containment, or secret rotation.
- Define cross-boundary revocation workflows Pre-agree who can disable access, rotate credentials, and validate containment when a supplier risk escalates.
What's in the full article
SecurityScorecard's full article covers the operational detail this post intentionally leaves for the source:
- A deeper explanation of TITAN AI's workflow changes for third-party risk teams and how the platform claims to reduce manual effort.
- The RSAC 2026 session context, including the board-level and partner conversations that shaped the announcement.
- Specific examples of how SecurityScorecard describes linking external threat intelligence to supplier exposure.
- The MOU context with Dataminr and the real-time exposure-to-threat correlation the article says it enables.
👉 Read SecurityScorecard’s RSAC 2026 analysis of TITAN AI and third-party risk →
Third-party risk monitoring and TPRM automation: what changes now?
Explore further
10/07/2026 9:41 pm
Static supplier assurance is no longer a defensible control model: the article reinforces that questionnaires and annual attestations lag the actual risk surface. Third-party exposure now changes continuously through integrations, delegated access, and service identities, which means governance has to measure live state rather than paper compliance. Practitioners should treat periodic assessment as evidence collection, not risk control.
A question worth separating out:
Q: Who is accountable when a supplier compromise affects customer systems?
A: Accountability usually sits across procurement, security, IAM, and the business owner of the integration, which is why responsibility becomes blurred during incidents. Mature programmes pre-assign who can revoke access, rotate secrets, and communicate containment status. That removes delay when the supplier relationship becomes an active security event.
👉 Read our full editorial: Continuous third-party risk monitoring is replacing static TPRM
