Topic starter
10/07/2026 9:19 pm
TL;DR: RSAC 2026 exposed a widening gap between manual third-party risk management and how supply chain risk actually materialises, according to SecurityScorecard, while its TITAN AI launch claims up to 95% less manual effort and up to 75% fewer supply chain breaches according to the company. Periodic questionnaires are no longer a credible operating model when exposure, intelligence, and remediation need to move together.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “RSAC 2026 Recap: What Did RSAC 2026 Reveal About the Future of TPRM? SecurityScorecard’s TITAN AI Sets the Pace”.
Key questions
Q: What breaks when third-party risk management stays questionnaire-based?
A: Questionnaire-only programmes miss real-time drift, hidden sub-processors, and changes in access scope.
A: Third-party relationships expand the attack surface and often sit outside the controls used for employees.
Q: What are the signs that third-party risk management is not working well enough?
A: A weak program usually shows up as duplicate manual reviews, slow follow-up on vendor issues, and mismatches between questionnaire answers and external risk signals.
Practitioner guidance
- Implement continuous monitoring for high-risk suppliers Move critical vendors from annual review cycles to always-on monitoring that tracks exposure, threat signals, and remediation status.
- Prioritise third-party access and credential review Inventory vendor accounts, tokens, support pathways, and delegated access so identity-bearing trust relationships are reviewed before contract renewal becomes the only checkpoint.
- Map concentration risk across suppliers and fourth parties Identify shared platforms and repeated dependencies where a single compromise could affect multiple business services or customers.
Bottom line: Static third-party risk management is losing relevance because vendor exposure changes continuously while questionnaires do not.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:41 pm
Continuous monitoring is now the governance baseline for third-party exposure. Annual questionnaires describe a supplier at one point in time, but they do not govern the supplier’s live attack surface, integration risk, or downstream dependence. That makes static TPRM structurally misaligned with modern supply chain operations. Practitioners should treat monitoring frequency as a control decision, not an operational preference.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams respond when a critical supplier’s exposure changes?
A: They should immediately reassess the supplier’s access scope, related dependencies, and whether monitoring alerts require containment or escalation. The priority is to understand what the supplier can reach, what the supplier shares with others, and how quickly the organisation can reduce exposure if the threat signal proves credible. Response should be tied to business criticality, not just ticket queue order.
👉 Read our full editorial: Continuous third-party risk monitoring is replacing static TPRM