Some companies see cybersecurity as a cost center. We see things a little different. LEARN MORE >
Experiencing a Breach?
BLOG
Is Third-Party Risk About to Become Your Biggest Problem?
JUMP TO: THE NUMBERS | WHY COMPANIES MISS IT | REGULATORY WAVE | MODERN TPRM | BOTTOM LINE
Not long ago, one of our Inversion6 CISOs sat down with a client for a routine cybersecurity risk assessment. The conversation took an unexpected turn when he asked about their third-party risk management program.
"They told me they handle everything via an Excel spreadsheet," he recalled. "I was horrified."
He pressed further. How many vendors do you work with?
"Five thousand."
Let that sink in. A major business handing critical client data in a major metro area is tracking 5,000 vendor relationships in a spreadsheet.
"So, you don't have any sort of third-party risk management tool?" our CISO asked.
"Nah. Business owners handle their own assessments."
This isn't an isolated case. It's symptomatic of a larger blind spot that's going to cost many companies dearly in the coming years.
The Numbers Don't Lie
If you're still treating third-party risk as a back-burner issue, the data says beware.
According to Verizon's 2025 Data Breach Investigations Report—considered the cybersecurity industry's definitive annual assessment—third-party breaches have now cracked the top five threat categories.
Last year alone, 30% of all major breaches were traced back to third-party vulnerabilities.
The harsh reality is that many high-profile breaches today involve some third-party component. The infamous Target breach in 2013? An HVAC contractor. SolarWinds? Third party. The CrowdStrike incident that took out Delta Airlines, Microsoft and several other major organizations last year? Third party.
Why Companies Keep Getting This Wrong
So why do organizations continue to underinvest in third-party risk management, even as the threat grows?
Part of the problem is perception. Third-party risk falls under governance, risk and compliance (GRC)—the unsexy corner of cybersecurity that doesn't get the same attention as incident response or security operations.
The sexy part of cybersecurity is security operations; Incident Response—threat hunting, that sort of thing. Everybody understands what a cyber incident is. But third-party risk management? That’s another story.
The result? Traditional third-party risk approaches remain slow, manual and reactive. Companies often conduct assessments at vendor onboarding, check a box and move on. They don't continuously monitor. They don't have real-time visibility when a partner gets breached. And they haven’t even begun to think about tracking fourth-party risks (the vendors of your vendors).
The Regulatory Wave Is Coming
According to our CISOs, regulatory bodies are about to start getting serious mandating third-party risk management.
They foresee a near future where PCI, SOC 2 or NYDFS are going to turn around and ask, 'What's your third-party risk management score?' And that's when companies are going to start taking things seriously.
Their take makes sense. Several NIST controls already touch on third-party risk, and those requirements are expanding. As supply chain attacks continue to dominate breach reports, compliance frameworks will likely follow the data.
Right now, it's just a few controls. But it may soon grow into an entire subcategory where companies get graded on how well they know their partners.
What a Modern TPRM Program Looks Like
The good news? You don't need to reinvent the wheel—or hire a full-time GRC team—to get ahead of this.
Tools like UpGuard (which we use in our own managed third-party risk service) can continuously monitor vendor security postures, ingest documentation like SOC 2 reports and produce risk scores based on real-time data.
But Inversion6's services don’t stop there; they expand to validate the output, provide executive summaries tailored for board-level visibility and work directly with vendors to help them remediate gaps.
Overall, it's a faster, more scalable approach. We can even identify when a client's vendor has a fourth-party breach and bring it to their attention immediately.
That's the kind of proactive monitoring you just can't get with a spreadsheet.
This model is also scalable to hundreds of vendors with minimal client lift. The client simply hands over a list of vendors, and Inversion6 takes care of the rest.
The Bottom Line
Third-party risk isn't going away. In fact, as businesses become more interconnected and reliant on external partners, it's only going to grow.
The question isn't whether third-party breaches will continue to climb the threat rankings—it's whether your organization will be ready when regulators start asking for proof of your TPRM program.
If you're managing vendors in a spreadsheet or conducting one-time assessments at onboarding, you're already behind.
Ready to take control of your third-party risk?
Learn how Inversion6's team of CISOs can help you get ahead of the problem before it becomes a breach.
