Vendor Risk Management in 2025

Verizon's 2025 Data Breach Investigations Report (DBIR), which analyzed more than 22,000 security incidents, found that third-party involvement in breaches doubled year-over-year — from roughly 15% to 30%. SecurityScorecard's 2025 Global Third-Party Breach Report, based on a separate sample of 1,000 breaches, put third-party-linked breaches at 35.5% for 2024, up 6.5 points from 2023. The exact figure moves by methodology and year, but every major source agrees on the direction: third-party involvement in breaches is rising fast, not holding steady. Older "60% of breaches involve third parties" claims still circulating online trace back to smaller or older studies and should not be cited as a current figure.

Four forces are converging. First, the numbers are getting worse — third-party breach involvement roughly doubled in Verizon's 2025 DBIR versus the prior year. Second, the cost is unusually high: IBM's 2025 Cost of a Data Breach report puts the average supply-chain compromise at $4.91 million and 267 days to identify and contain — the longest of any breach type, because it exploits a trust relationship instead of a technical flaw. Third, regulation has teeth now: the EU's DORA has applied to financial entities since January 17, 2025, and NIS2 began issuing administrative penalties in 2026. Fourth, vendors increasingly embed AI features and third-party models, adding a whole new category of risk that most vendor questionnaires still don't ask about.

A questionnaire (SIG, CAIQ, or a custom form) is a snapshot — it tells you what a vendor's security posture looked like, and how honestly they described it, on the day they filled it out. Continuous monitoring uses externally observable signals — exposed services, leaked credentials, certificate hygiene, DNS misconfiguration, dark-web chatter — to track posture between assessments. Neither replaces the other. Questionnaires surface internal controls (encryption policy, access reviews, incident response plans) that external scanning can't see; continuous monitoring catches drift and new exposure in the eleven months a year most organizations aren't asking their vendors anything at all.

Fourth-party risk is the risk introduced by your vendors' own vendors — the cloud host, payment processor, or subcontractor your SaaS provider relies on, which you never contracted with and usually can't see. It matters because a breach two or three hops away can still reach your data; the 2020 SolarWinds and 2023 MOVEit incidents each cascaded through hundreds of organizations that had no direct relationship with the original compromised vendor. Most VRM programs stop at first-party vendor assessment. A more mature program asks critical vendors to disclose their own critical subprocessors at onboarding and renewal.

The EU's Digital Operational Resilience Act (DORA) has applied to financial entities operating in the EU since January 17, 2025, and it requires a formal ICT third-party register, pre-contractual risk assessment, and specific contract clauses covering audit rights and exit strategies. It only binds EU-regulated financial entities directly, but it affects everyone else two ways: any US or global vendor selling into EU financial services now has to meet DORA's contractual requirements, and regulators elsewhere (including US banking regulators and NIS2 in the broader EU economy) are converging on the same expectations — a documented vendor inventory, tiering by criticality, and evidence of ongoing oversight rather than a one-time sign-off.

Concentration risk is the exposure created when many of your critical functions — or an entire industry's — depend on the same small set of providers. In November 2025, EU regulators published the first official list of Critical ICT Third-Party Providers (CTPPs) under DORA: 19 companies, including AWS, Microsoft, Google Cloud, Oracle, SAP, and IBM, now subject to direct regulatory inspection because so much of the financial sector runs on them. You don't need to be EU-regulated to have this problem — if a single cloud region, identity provider, or payment processor going down would take out multiple business-critical systems at once, that's concentration risk, and it's worth mapping even if no regulator is asking you to.

Treat embedded AI as a distinct risk category in vendor due diligence, not an extension of general security review. Ask what model or model family the vendor uses, whose data trained it, where inference runs, whether your data is used to train or fine-tune the model, and whether there's a human in the loop for consequential decisions. IBM's 2025 Cost of a Data Breach report found breaches involving unsanctioned "shadow AI" cost roughly $670,000 more on average than the overall mean and were a contributing factor in about one in five breaches — largely because employees fed sensitive data into tools nobody vetted. The same blind spot exists one layer out, in the AI features vendors quietly ship into products you already approved.

Tie frequency to tier, not to a calendar default. Critical vendors — those with access to sensitive data or systems whose outage would stop the business — warrant continuous external monitoring plus an annual deep-dive questionnaire and a review at any material change (new subprocessor, ownership change, breach disclosure). Mid-tier vendors can run on annual or biennial questionnaires with lighter continuous monitoring. Low-risk vendors (no sensitive data access) mostly need a one-time onboarding check and a trigger-based review if their access scope changes. A flat "reassess everyone annually" policy wastes effort on low-risk vendors while under-watching the handful that can actually hurt you.

Inventory first, tier second, assess third. Most organizations underestimate their vendor count badly, so start by pulling every active SaaS subscription, API integration, and signed contract you can find — accounts payable and your SSO/identity provider's app list are both good sources. Tier what you find by data sensitivity and system criticality, not vendor size. Then run continuous, automated monitoring across the full list immediately (it requires no vendor cooperation) while you roll out deeper questionnaires to the critical tier first. Trying to deeply assess every vendor on day one is why so many VRM programs stall before they cover their real exposure.