From Trust to Security: Third-party Risk Management Strategies and Challenges

• Third-party risk management is increasingly challenging for organizations due to the complexity of managing numerous external partners, with over half of respondents having experienced a third-party security breach in the past year.
• Many companies lack sufficient visibility into the security practices of their third- and fourth-party partners, which heightens vulnerability to breaches and hinders effective oversight.
• Despite growing awareness of third-party risks, investments in improving third-party security management remain limited, with a significant portion of companies failing to allocate adequate resources to address these risks.

Managing third-party risk has become a critical concern for enterprises, as the complexity of modern IT environments involves numerous external partners. The 2024 CyberRisk Alliance survey revealed that more than half of respondents experienced a third-party security breach in the past 12 months, underscoring the urgent need for improved risk management strategies. Many companies work with dozens, if not hundreds, of external partners, and maintaining clear oversight of these relationships has proven difficult. This lack of visibility into third-party security practices creates significant blind spots, making it challenging to enforce adequate security measures.

The survey also found that software vendors are the most common source of third-party breaches, followed by IT service providers and business partners. However, despite growing awareness of the risks posed by third- and fourth-party partners, many organizations are not investing enough in mitigating these threats. Only 13% of companies are making substantial investments in third-party security, while over 40% report allocating little to no budget for this area. This lack of investment leaves many organizations vulnerable to breaches and underscores the need for more proactive risk management strategies.

Third-party risk assessments are a key tool for addressing these issues, but many companies are not conducting them comprehensively. Just over half of respondents conduct annual third-party risk assessments, and only 54% rate these assessments as “in-depth.” This gap between awareness and action highlights the need for organizations to implement more robust third-party risk management practices, including regular assessments, better visibility into partners’ security measures, and increased investment in third-party security solutions.

Read the full article