Third-Party Risk Management and Governance Challenges for CISOs
CISOs are increasingly confronted with the complexities of third-party risk management, as reliance on a vast ecosystem of external vendors and SaaS providers exposes organizations to significant operational and security risks. The challenge is compounded by the growing number of cyberattacks targeting third-party software, such as the incident involving APT29's attack on TeamViewer, which highlights the vulnerability of widely used remote access tools. Effective risk management requires not only identifying and monitoring these external dependencies but also ensuring transparency and accountability throughout the software supply chain.
In parallel, the evolving landscape of digital trust—exemplified by the shortening of TLS/SSL certificate lifespans to 47 days—demands that organizations treat certificate management as a critical business continuity function rather than a routine IT task. Governance and risk management frameworks must adapt to these operational realities, emphasizing proactive decision-making, clear accountability, and automation readiness to prevent outages and maintain resilience. CISOs must align security strategies with business objectives, ensuring that risk ownership and governance are embedded at every level of the organization.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
CA/B Forum-approved move to 47-day certificate lifespans highlighted
By January 2026, industry plans to reduce TLS/SSL certificate lifespans to 47 days by 2029 were being emphasized as a major operational shift, requiring enterprises to adopt automated certificate lifecycle management to avoid outages and prepare for crypto-agility.
APT29 targets TeamViewer in third-party supply chain attack
In June 2024, the Russian APT29 group targeted TeamViewer, underscoring the risk that compromises of widely used third-party providers can create broad downstream business disruption for customer organizations.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISO Challenges in Managing Cybersecurity Risk Amid AI and Expanding Attack Surfaces
Chief Information Security Officers (CISOs) are facing increasing complexity in managing cybersecurity risk as organizations become more reliant on managed service providers (MSPs), integrate artificial intelligence (AI) into business processes, and contend with expanding attack surfaces. Nearly half of organizations reported a cyberattack or data breach involving a third-party in the past year, highlighting the growing importance of robust vetting and governance processes for service providers. At the same time, the rapid adoption of AI has elevated cybersecurity to a top priority at the board level, with CISOs now expected to communicate risk and strategy more effectively to executive leadership. However, internal conflicts, unclear authority, and misaligned incentives between CISOs and other business leaders are often more damaging to incident response than the cyberattacks themselves, according to recent industry surveys. The threat landscape is intensifying, with a 20% year-on-year increase in high-severity vulnerabilities and attackers leveraging generative AI to exploit both new and old weaknesses. Security teams are under pressure to manage a greater volume of serious issues without corresponding increases in staff or budget, leading to operational strain. Effective vulnerability management now requires clear governance, defined scope, and continuous evaluation, while CISOs must balance technical risk reduction with business alignment and shared responsibility across the organization. As AI accelerates both attack and defense, CISOs are urged to rethink traditional risk management processes and foster stronger leadership alliances to ensure resilient cybersecurity postures.
Mar 21, 2026
Escalating Software Supply Chain Security Risks and Industry Response
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Mar 21, 2026
Third-Party and Partner Risk as Core Enterprise Security Challenge
Modern enterprises face significant cybersecurity risks stemming from their reliance on third-party vendors, cloud providers, and business partners. As organizations increasingly integrate external entities into their core operations, the traditional view of third-party risk as a peripheral or compliance-only concern is no longer sufficient. Regulatory frameworks such as GDPR, NIS2, and SEC disclosure rules now hold enterprises directly accountable for breaches and incidents involving their suppliers, making third-party failures a direct threat to operational resilience, brand reputation, and legal standing. Effective management of these risks requires a shift toward governance-first, business-aligned strategies that treat third-party and partner risk as integral to enterprise security. Establishing clear data governance frameworks, defining accountability, and ensuring alignment on security practices are essential for secure collaboration. The exposure of hundreds of millions of records in recent breaches highlights the urgency for organizations to address not only technical vulnerabilities but also the complexities of data sharing and trust across their extended digital ecosystems.
Mar 21, 2026