All posts
|6 min read

You are most vulnerable on the attack surfaces you don't control

30% of breaches now originate from third parties. Your vendors are your weakest link and most companies check them once a year.

vendor-risksupply-chainthird-party-riskTPRMdata-breaches

You can lock down your own infrastructure, pass every audit, train every employee, and still get breached through a vendor you forgot to assess.

It happens constantly. And it is getting worse.

The numbers

Verizon's 2025 Data Breach Investigations Report found third-party involvement in breaches doubled year over year, from 15% to 30%. SecurityScorecard puts the number higher: 35.5% of all 2024 breaches originated from third-party compromises. For ransomware specifically, 41.4% of incidents had a third-party component.

However you slice it, roughly one in three breaches now starts with someone else's system.

IBM's 2025 report priced it: supply chain compromise is the second most costly attack vector at $4.91 million per breach. And it takes the longest to detect. Third-party breaches averaged 267 days to identify and contain. That is nine months of exposure before anyone notices.

Between 2021 and 2023, supply chain attacks surged 431%. By 2025, they had nearly doubled again to 25 incidents per month. Cybersecurity Ventures projects the global annual cost hitting $138 billion by 2031.

This is not a trend that is slowing down.

The scale of the problem

The average company now manages 286 vendors. Mid-market firms run 200 to 1,000. Enterprises manage over 1,000. And that is just formal vendor relationships. The average organisation uses 112 SaaS applications on top of that.

Now look at the other side: 48% of organisations have only one or two full-time employees dedicated to third-party risk management. The average TPRM professional is responsible for assessing 33.6 vendors.

286 vendors. One or two people. Do the maths.

How most companies assess vendors today

Once a year. With a questionnaire.

That is not an exaggeration. The dominant model for third-party risk management is an annual self-assessment questionnaire sent to each vendor. The vendor fills it in (or copy-pastes last year's answers), someone on the security team reviews it, and the vendor gets a pass or a follow-up.

That creates 364 days of blindness between reviews. A vendor could suffer a major breach in February and you would not know until your next scheduled assessment in January. Nine months of exposure is not a hypothetical. It is the measured average.

Large vendors receive dozens or hundreds of these questionnaires annually. Many are nearly identical. The answers are rushed, recycled, and rarely verified. The entire process is built on trust, which is exactly the thing it is supposed to be evaluating.

What happens when a vendor gets breached

Chain IQ (June 2025): Procurement vendor Chain IQ Group AG was breached, exposing over 130,000 employee records from client firms including UBS and Pictet. The leaked data included direct phone numbers for senior executives, including the UBS CEO.

Change Healthcare (2024): A ransomware attack on this single healthcare vendor exposed data belonging to 190 million individuals. The largest healthcare data breach ever recorded. UnitedHealth spent over $2 billion responding.

Qantas (2025): A third-party customer service platform was breached, resulting in over 6 million customer records being extracted. Qantas did not get hacked. Their vendor did.

Cleo/Sam's Club (2024-2025): The Clop ransomware group exploited a zero-day in Cleo's file transfer software and publicly named Sam's Club as a victim.

None of these companies were breached directly. Their vendors were. And in every case, it was the company's customers whose data was exposed.

The uncomfortable truth

Most security programmes are inward-facing. They protect the perimeter, harden the infrastructure, train the staff. That is necessary. It is also incomplete.

Your attack surface does not end at your firewall. It extends to every vendor that touches your data, every SaaS tool your team signed up for, every integration that runs in the background. You do not control those systems. You probably do not monitor them either.

A 2024 BlackBerry survey found that 75% of organisations have already experienced a software supply chain attack within the past year. Three out of four. And most of them found out the hard way.

What continuous monitoring changes

The gap between annual questionnaires and reality is where breaches live. Nine months of undetected exposure. Vendor security postures that degrade between reviews. New findings that appear weeks after the last assessment.

Continuous external monitoring closes that gap. Not with questionnaires. Not with self-reported compliance claims. With automated scans that check what is actually observable: DNS configuration, TLS posture, email authentication, cookie consent compliance, exposed assets, security headers, and hundreds of other signals.

It will not catch everything. No external scan sees inside a vendor's network. But it catches the things that are publicly visible and measurable. And when a vendor's external posture starts degrading, you know about it before it becomes a headline.

What to do

  1. Know your vendor count. If you cannot list every third party that processes your data, start there. You cannot secure what you have not inventoried.
  2. Stop relying on annual questionnaires alone. They are a baseline, not a strategy. Supplement them with continuous external monitoring.
  3. Prioritise by data access. Not every vendor carries the same risk. Focus monitoring on vendors that handle customer data, authentication, payments, or infrastructure.
  4. Set thresholds and act on them. Continuous monitoring is only useful if findings trigger action. Define what score or finding severity triggers a vendor review.
  5. Make it part of procurement. Scan vendors before you sign, not after a breach makes the news.

Sources

Want to see what your security posture looks like from the outside?

Scan any domain free