Third-Party and Partner Risk as Core Enterprise Security Challenge
Modern enterprises face significant cybersecurity risks stemming from their reliance on third-party vendors, cloud providers, and business partners. As organizations increasingly integrate external entities into their core operations, the traditional view of third-party risk as a peripheral or compliance-only concern is no longer sufficient. Regulatory frameworks such as GDPR, NIS2, and SEC disclosure rules now hold enterprises directly accountable for breaches and incidents involving their suppliers, making third-party failures a direct threat to operational resilience, brand reputation, and legal standing.
Effective management of these risks requires a shift toward governance-first, business-aligned strategies that treat third-party and partner risk as integral to enterprise security. Establishing clear data governance frameworks, defining accountability, and ensuring alignment on security practices are essential for secure collaboration. The exposure of hundreds of millions of records in recent breaches highlights the urgency for organizations to address not only technical vulnerabilities but also the complexities of data sharing and trust across their extended digital ecosystems.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Executive briefing frames third-party risk as enterprise risk
A briefing published on 2026-01-02 argued that third-party risk should be treated as a core enterprise risk because vendors, cloud providers, and partners are deeply integrated into business operations. It highlighted regulatory accountability under frameworks including GDPR, NIS2, DORA, and SEC rules, and recommended governance, continuous assurance, and resilience planning.
CIO article highlights IBM-Securitas partnership as a cybersecurity model
A CIO article published on 2025-12-31 presented the Vested security agreement between IBM and Securitas as an example of collaborative, outcome-focused cybersecurity partnership. The piece argued that organizations should adopt clearer governance, standardized data practices, and shared accountability when working with external partners.
Over 345 million records exposed in 8,000+ breaches in H1 2025
In the first half of 2025, more than 345 million private records were exposed across over 8,000 reported data breaches. The statistic was cited as evidence of the growing cybersecurity risks tied to weak data governance and partner data-sharing practices.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Third-Party AI and Identity Risks in Enterprise Security
Organizations face increasing cybersecurity risks from third-party vendors, particularly as these partners integrate artificial intelligence into their operations. Without clear contractual clauses requiring disclosure of AI use, data handling restrictions, and explicit liability assignments, enterprises may be exposed to hidden liabilities, regulatory penalties, and reputational harm. The lack of transparency in how vendors deploy AI—such as chatbots or embedded analytics—can result in compliance gaps, especially when sensitive data is involved and oversight is insufficient. Experts emphasize the importance of robust identity governance and privileged access management to mitigate third-party cyber exposure. Real-world cases highlight how partner connections, contractors, and machine-to-machine identities can expand the attack surface, with AI-driven threats further complicating the landscape. To address these challenges, organizations are advised to enforce least privilege, implement just-in-time access, strengthen authentication, and ensure compliance with regulatory frameworks like NIS2 and DORA, thereby maintaining control over third-party access and reducing overall risk.
Mar 21, 2026
Third-Party Risk Management and Governance Challenges for CISOs
CISOs are increasingly confronted with the complexities of third-party risk management, as reliance on a vast ecosystem of external vendors and SaaS providers exposes organizations to significant operational and security risks. The challenge is compounded by the growing number of cyberattacks targeting third-party software, such as the incident involving APT29's attack on TeamViewer, which highlights the vulnerability of widely used remote access tools. Effective risk management requires not only identifying and monitoring these external dependencies but also ensuring transparency and accountability throughout the software supply chain. In parallel, the evolving landscape of digital trust—exemplified by the shortening of TLS/SSL certificate lifespans to 47 days—demands that organizations treat certificate management as a critical business continuity function rather than a routine IT task. Governance and risk management frameworks must adapt to these operational realities, emphasizing proactive decision-making, clear accountability, and automation readiness to prevent outages and maintain resilience. CISOs must align security strategies with business objectives, ensuring that risk ownership and governance are embedded at every level of the organization.
Mar 21, 2026
Escalating Software Supply Chain Security Risks and Industry Response
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Mar 21, 2026