Emerging Threat
How to Manage Emerging Supply Chain Threats
Vendor Risk Management (VRM) is the process of identifying, assessing, mitigating, and monitoring the risks associated with third-party suppliers and service providers. It goes beyond security questionnaires. Done well, VRM helps protect your organisation from financial loss, compliance breaches, operational downtime, and reputational damage triggered by third-party failures.
VRM isn’t just for the cybersecurity team either. It touches procurement, finance, legal, risk, and the board. Why? Because vendors now play a critical role in your digital operations, customer trust, and business continuity.
As organisations grow and scale, they often bring on a number of new vendors, third-parties, and partners that have a range of technical integrations and non-technical interdependencies. Third-party vendors help organisations move faster and bypass the need for in-house experts and departments. A study last year found that the organisations using more than 1,000 third-party vendors more than doubled from 14% to 31%.
However, amassing a high number of third-parties can also result in a complicated vendor ecosystem that’s difficult to manage and properly utilise. This can overburden teams and departments, and increase third-party risk, which is a growing concern for many organisations. Globally, 84% of organisations are worried about supply chain and other third-party risks and as we saw from recent zero-day vulnerabilities such as log4J, third-party risks can lead to security compromises.
organisations need to have a proper vendor management system and process in place in order to mitigate third-party risk.
Bringing on new vendors often requires multiple stakeholders. In short:
Even under ideal scenarios, this process can take up to six months for large organisations. While agile companies have the benefit of moving much faster, if there’s no formal system in place and every vendor procurement process is done ad-hoc, it can result in an inefficient system that will slow down your organisation and the various departments above, ultimately costing a company in productivity. The same lengthy vendor vetting, onboarding, and implementation process applies to any cybersecurity vendors which means, without a streamlined process, an organisation stays in a vulnerable and exposed state for a longer time.
To offset this lengthy process, some departments may shortcut essential aspects of the vendor vetting, onboarding, and implementing process. One of the first to go? Security. Security due diligence is often skipped over or deprioritised, putting you in a tough position. You want to make sure that the organisation is secure and is managing risk appropriately but you may face a lot of pushback if it seems like it will slow things down too much.
When considering the vast number of vendors an organisation may work with, it can result in an elevated risk for the organisation. And this risk can be quite costly and severe.
If an organisation chooses to skip proper third-party party risk assessment and due diligence, it can result in a shaky vendor ecosystem that’s not only potentially overwhelming your organisation, but also exposing you to risk. Here’s how.
If you don’t have the right vendor management system or process in place, your organisation might end up working with an outright risky vendor without even knowing it. Your department might not be alerted to a new vendor that the marketing department decided to use months ago. If it turns out the vendor doesn’t have the right security practices or is non-compliant, that risk will pass to you since your organisation is responsible for ensuring secure handling of any information and data via a third-party. It can also result in a heightened risk and exposure can also lead to a cyber security incident such as a data breach, or a ransomware infection that eventually reaches your environment.
Given the recent focus on third-party risk by standards such as NIST, third party risk management has become a key component for regulatory and compliance priorities and many governing bodies are finding culpability in first party companies for third-party errors. Morgan Stanley was fined $35M by the SEC for failing to monitor a third-party vendor they hired to properly dispose and destroy hard drives containing PII of millions of people.
If organisations prioritise speed over security, integration between vendors may be done in a risky way. For example, a third-party communication platform (like Slack) might not have MFA/2FA in place, which can expose them to account takeover attacks. Or a cloud-service provider might be misconfigured, allowing unauthorized users to access data with minimal effort. Misconfigured S3 buckets are responsible for dozens of data breaches simply because they weren’t set up correctly.
Lastly, having too many vendors results in an overburdened organisation and department. Even if you have the best intentions to vet and reduce your third-party risk, not having a streamlined TPRM system with tools and technology in place, the complexity and resources required is just too much.
With so many vendors, you may find yourself limiting your TPRM and selecting those you believe to be "most critical" to focus your attention. There are two major pitfalls with this approach:
Ultimately, this process can result in a problem of unknown and missed risk that will snowball with time and may become unmanageable until the worst occurs - a data breach, an exposure, or hefty regulatory fines
TPRM is an essential aspect of third-party management and, when done properly, will actually result in a more efficient and productive vendor management system.
Malicious hackers are very aware that major third-party suppliers and vendors, if exposed, can give them access to hundreds or thousands of companies. If a third party fails to update a key application or device, has poor authentication controls which leads to an impersonation or account takeover attack, or doesn’t have the right network security in place to prevent an attacker from accessing critical files, that exposure can then lead directly to you.
Without any third-party risk management system in place, you’re essentially just crossing your fingers and hoping that the hundreds of vendors you work with are maintaining top cybersecurity hygiene. This is why cyberattacks against companies like SolarWinds can be so dangerous. If you’re not maintaining the proper risk management, you can suddenly turn into an easy target if a major third-party suffers a big attack.
This isn’t a hypothetical scenario, either. In the last 12 months, 54% of organisations suffered a breach via their third-parties.
Looking for some software to help you manage your Third Party Risk process? Read our comprehensive analysis of the different tools on the market.
Organisations need to invest in third-party risk management via key controls, processes, policies and technologies. While it may seem daunting and overwhelming, an organisation can still properly address their third-party risk without a large department and headcount. Here are some key steps you can take.
Engage with other departments: Making your security department visible, accessible, and something other departments want to engage with can help reduce friction and help them get on board with your security policies and processes. Give them useful cybersecurity tips and resources that can help them outside of work and make sure you’re communicating effectively so they see your department as a helpful resource rather than one that will slow things down.
Prioritise visibility: It’s nearly impossible to manage the risk of something you can’t see. Shadow IT is a major problem, especially with the shift to remote work, and third-parties you’re not aware you’re working with can be especially risky. Starting with processes that create transparency and communication when new third-parties are brought on can help ensure you’re accounting for new vendors. You may also want to invest in environment detection and monitoring tools that take stock of your environment to help improve your overall visibility.
Work with your third parties to improve your risk mitigation: You can work with your legal team to ensure that contracts between you and a third-party vendor have clauses in place that require them to communicate any potential risks, vulnerabilities, and data breaches within a reasonable time frame. Faster communication can help you act and react faster, helping prevent even worse consequences.
However, it’s also important to build good relationships with your vendors and create communication channels that will help them provide more accurate risk assessments, improve their risk posture as you continue working with them, and quickly (and honestly) report any incident in case it happens. You don’t want your first meeting with a third party to be one where something goes wrong. Relationships matter.
Have a way to understand their cybersecurity: Having a due diligence process and deploying helpful tools that helps you understand your current and future third parties’ risk posture is an easy way to spot risky vendors and reduce unnecessary risk. It will also help you find ways to collaborate and improve your vendors’ risk posture, work on risk mitigation, and help you make more informed decisions about your own security controls.
Vendor risk sits at the centre of multiple regulatory frameworks:
If you’re only focused on cybersecurity risk, you’re missing the full picture. Vendor risk is multi-dimensional. Here’s what should be on your radar:
Too many guides overcomplicate this. Here’s a straight-talking, four-stage approach that actually works:
Start by getting full visibility of who your vendors are. This includes shadow IT, fourth-party dependencies, and internal tooling. You can’t manage what you don’t know.
Pro tip: Work with procurement and finance to map all supplier contracts, software usage, and integrations.
Assess each vendor’s risk based on the data they handle, systems they access, and services they deliver. This means security reviews, but also operational and financial assessments.
Pro tip: Prioritise based on impact. Not all vendors need a deep dive, but your crown jewels suppliers definitely do.
Work with high-risk vendors to close gaps. This could involve improving controls, switching to more resilient providers, or reworking contracts.
Pro tip: Don’t just throw paperwork at the problem. Establish trusted communication channels with key vendors to solve problems faster.
Vendor risk isn’t static. Build continuous monitoring into your processes, using a mix of threat intelligence, supplier updates, and control attestations.
Pro tip: Make ongoing risk reviews a part of supplier relationships — not a once-a-year box-ticking exercise.
Companies across the world are using Risk Ledger to consolidate their vendors into one easy-to-use platform, get a real-time snapshot of the security of their entire supply chain and easily spot potential vulnerabilities. Interested in learning more? Use the form below to speak to a member of our team.
Vendor Risk Management (VRM) is the end-to-end process of identifying, assessing, mitigating, and continuously monitoring the risks associated with your third-party suppliers. It’s not just about filling out a questionnaire once a year. A mature VRM process helps protect against security breaches, compliance violations, service disruption, and financial exposure.
At a high level, the process looks like this:
In 2025, with evolving regulations and constant third-party attacks, static or paper-based VRM processes are no longer enough.
Vendor risk is not one-dimensional. To build a truly resilient supply chain, you need to account for multiple risk categories:
Understanding these risks helps you prioritise which vendors need closer scrutiny — and where your biggest exposure lies.
While many organisations use slightly different terms, the five commonly accepted stages of risk management are:
A vendor risk assessment is the practical heart of any good VRM programme. Here’s a clear, repeatable nine-step process:
Sign up to our monthly newsletter to receive exclusive research and analyses by our experts, the latest case studies from our clients as well as guides, explainers and more to turn your supply chain risk management programme into a resounding success story.
