Organisations Know Third-Party Cyber Risk Is Serious but Fail to Act, CyberGRX Study Finds

Most organisations accept that their suppliers and partners expose them to serious cyber risk, yet many do little about it, according to research commissioned by CyberGRX, which describes itself as the operator of the world's first and largest global risk exchange. Forrester Consulting carried out the study, surveying 319 people in IT, security and risk roles across technology, retail, oil and gas, healthcare, financial services and other heavily regulated sectors.

The report, titled Why Isn't Your Organisation Prioritising Third-Party Risk?, concludes that organisations are struggling with third-party cyber risk management (TPCRM) and that gaps in how they currently handle it make cyber incidents more likely.

Four findings from the Forrester research

1. Confidential data flows to third parties all the time. That exchange puts both sides at significant risk. Many enterprises expect these data supply lines, made possible by cloud and software-as-a-service (SaaS) adoption, to become more important. The proportion of data shared with third parties is set to climb over the next five years, from 30% to 41% by 2026.
2. Existing prevention strategies leave gaps. Companies find it hard to manage the risk their third parties bring, partly because they do not prioritise it and partly because of how they go about it. Ninety-five percent of respondents said their organisation had faced a challenge in managing third-party risk, whether of strategy or of technology. Without proper oversight, companies are open to threats such as data loss and ransomware.
3. Organisations already hurt by a third-party incident often ignore sound practice. Those that have suffered such an incident say they are more worried about the risk. Even so, they tend to share more of their critical data with third parties (30%) than organisations that have not been hit (22%), and they are less likely to have tools in place to reduce third-party risk.
4. Reducing third-party risk takes a different strategy and different technology. The study calls for a new strategic outlook that is holistic, focused on the whole ecosystem and centred on cybersecurity, backed by updated assessment of third parties, standardised processes and better technology.

Dave Stapleton, CyberGRX's chief information security officer, said that organisations which do not take careful steps to monitor, defend against and prepare for third-party incidents have undermined their whole security posture. Many recognise the dangers, he said, but what they do does not amount to effective mitigation, and without a defined TPCRM strategy a breach becomes possible even when internal risk management is otherwise sound.

What the study recommends

The research advises organisations to treat vendors as an extension of their own brand and to set a strict baseline and clear expectations for their cyber maturity. Data and automation should be used to confirm that the entire supply chain meets those requirements. Vendors' cyber risk also needs continuous monitoring, because a supplier's security posture can change quickly as new attack methods appear. Finally, all parties should keep talking about security posture and compliance, and security training should be compulsory for employees and stakeholders.

Stapleton and Forrester principal analyst Renee Murphy were scheduled to present the main findings and recommendations in a webinar on Tuesday, October 12, at 2:00 pm EDT.