Description

For organizations, large and small, the use of third-party vendors in a variety of functions is a recurring part of their operations. And like malicious insiders, cyber criminals, hactivists, and nation-states, the cyber risks associated with third-party vendors should receive similar attention across all stages of cyber risk management: identification, assessment, prevention, and response. However, as we show in this insight, most organizations admit they are not managing third-party risk adequately, and project that this situation will worsen.

Building from our research on the managed and professional security services market, we contend that TPRM is a business opportunity with strong upside for security services providers. However, in our opinion, for these providers to gain that upside, their proficiency in TPRM must be melded with their existing assets and attributes, and packaged for organizations of all sizes. Before describing how our bullish view on the business opportunity in TPRM can materialize, we review available research on organizations’ viewpoints on third-party risk.