Third-party risk is now one of the main sources of breach risk. Verizon’s 2026 Data Breach Investigations Report (DBIR) found that a third party was involved in 48% of breaches, up 60% from the previous year’s dataset. At the same time, rules that are already in force, including the EU’s Digital Operational Resilience Act (DORA, applicable since January 17, 2025), the NIS2 Directive, the SEC’s 2023 cybersecurity disclosure rules and NIST CSF 2.0, expect organizations to show how they oversee their vendors.
Organizations run on interconnected ecosystems of cloud platforms, SaaS providers, AI services, payment processors and strategic partners. Regulators, customers and insurers want visibility, accountability and operational assurance across those relationships, and mature programs respond with continuous insight into vendor security, data handling and operational reliability.
Leading programs in 2026 connect cybersecurity, privacy, resilience and business continuity into one view of organizational risk. The trends below describe where third-party risk management (TPRM) stands today and what is driving it.
Why are third-party breaches rising in 2026?
Organizations rely on more outside services and software every year, and attackers follow that dependency. In Verizon’s 2026 DBIR (covering incidents from November 1, 2024, to October 31, 2025), breaches with third-party involvement reached 48% of all breaches. The same report found that only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication (MFA) on their cloud accounts, and that resolving half of the weak-password and permission-misconfiguration findings took almost eight months.
The European picture is similar. The ENISA Threat Landscape 2026, published in September 2026 and based on 8,257 incidents recorded in 2025, reports that cybercriminals increasingly targeted third-party providers such as digital services, and that adversaries exploited the digital supply chain by compromising software, repositories and browser extensions, including popular libraries and npm packages.
For risk teams, this means vendor security is part of the organization’s own attack surface. It helps to have a plan before a supplier is hit; see what to do if you have a third-party data breach.
Why are vendor risk and internal risk managed together?
In practice there is little difference between your internal systems, your vendors and your supply chain. Vendor risk management works best as an integral part of your internal risk and compliance program, with a holistic approach to third-party risk and one platform for internal and vendor risk.
Frameworks now say the same thing. NIST released version 2.0 of its Cybersecurity Framework (CSF 2.0) on February 26, 2024, with a new Govern function that includes a Cybersecurity Supply Chain Risk Management category (GV.SC). Its first outcome, GV.SC-01, is that “a cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders.” You can map your vendor program to the NIST CSF 2.0 framework.
Keeping all risk data and threat intelligence in one place gives you a better picture of where your organization and its vendors stand at any given time than a third-party risk management questionnaire alone, though questionnaires remain important.
Start Getting Value With
Centraleyes for Free
See for yourself how the Centraleyes platform exceeds anything an old GRC
system does and eliminates the need for manual processes and spreadsheets
to give you immediate value and run a full risk assessment in less than 30 days
What do DORA’s ICT third-party rules require in 2026?
DORA (Regulation (EU) 2022/2554) has applied since January 17, 2025. Article 28 of DORA requires financial entities to manage ICT third-party risk as an integral part of ICT risk, to remain fully responsible for their obligations when they outsource, and (except for some smaller entities) to adopt a strategy on ICT third-party risk. Financial entities must also keep a register of information on all contractual arrangements for ICT services, report to their competent authority at least yearly on new arrangements, and inform it in a timely manner about planned arrangements that support critical or important functions.
The EU now also supervises the largest providers directly. On November 18, 2025, the European Supervisory Authorities (EBA, EIOPA and ESMA) designated the first critical ICT third-party providers under DORA, using data from financial entities’ registers of information. The published list names 19 providers, including Amazon Web Services EMEA, Google Cloud EMEA and Microsoft Ireland Operations. For a deeper look, read our guide to DORA’s third-party risk standards and achieving DORA compliance.
How do NIS2 and the SEC rules affect vendor oversight?
Under the NIS2 Directive (EU) 2022/2555, Member States had to transpose the directive by October 17, 2024. Article 21(2)(d) lists “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” among the required risk-management measures, and Article 21(3) requires entities to take into account the vulnerabilities specific to each direct supplier and the quality of its products and cybersecurity practices. Article 20 makes management bodies approve those measures, oversee them and answer for infringements. Learn more about the NIS2 framework.
In the United States, the SEC adopted its cybersecurity disclosure rules on July 26, 2023. Item 106 of Regulation S-K, added by the final rule (Release No. 33-11216), asks public companies to describe their processes for assessing, identifying and managing material cybersecurity risks, including “whether the registrant has processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider.” See how the SEC cybersecurity reporting requirements affect public companies.
What does the EU Cyber Resilience Act mean for software suppliers?
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets security requirements for products with digital elements, which covers much of the software and hardware organizations buy from vendors. Manufacturers’ obligations to report actively exploited vulnerabilities and severe incidents (Article 14) apply from September 11, 2026, and the rest of the regulation applies from December 11, 2027. Buyers can start asking suppliers how they plan to meet these duties. Read more about the EU Cyber Resilience Act.
How is AI changing third-party risk management?
AI arrives through vendors as well as through your own projects. Verizon’s 2026 DBIR found that 45% of employees are now regular users of AI on their corporate devices (up from 15% the previous year), that 67% of users access AI services with non-corporate accounts, and that this “Shadow AI” is now the third most common non-malicious insider action in its data loss prevention dataset. Source code was the most common data type submitted to external GenAI models.
That makes AI questions part of vendor due diligence: which AI services a supplier uses, what data they send to them and how the models are governed. In the EU, obligations for general-purpose AI model providers have applied since August 2, 2025, and most EU AI Act obligations apply from August 2, 2026, while Regulation (EU) 2026/1744 moved the high-risk system obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
Why are point-in-time vendor questionnaires no longer enough?
Vendor risk changes faster than an annual review cycle. Verizon’s 2026 DBIR found that exploitation of vulnerabilities is now the most common initial access vector, at 31% of breaches, while credential abuse fell to 13%. Only 26% of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog were fully remediated in 2025, and the median time to full resolution rose to 43 days.
A vulnerability in a vendor’s product or environment can become your incident within days. Leading programs combine a structured vendor assessment at onboarding with continuous monitoring of vendor security posture, and refresh assessments when a vendor’s risk changes. Our third-party risk assessment checklist covers the questions to ask.
How do privacy laws and ESG affect vendor due diligence?
Vendors that process personal data on your behalf bring your privacy obligations with them. In the United States, the list of state privacy laws keeps changing, so check which ones apply to you in our state privacy laws tracker.
Environmental, social and governance (ESG) questions also remain part of many vendor reviews, although EU reporting duties are narrowing. Directive (EU) 2026/470 of February 24, 2026 (the Omnibus I simplification package) focuses Corporate Sustainability Reporting Directive (CSRD) obligations on larger companies; it entered into force on March 18, 2026, and Member States must transpose the sustainability reporting changes by March 19, 2027. See how to manage compliance with ESG reporting frameworks.
What should a third-party risk program focus on in 2026?
- Keep a complete, current inventory of vendors and the services and data each one touches (DORA calls this the register of information).
- Tier vendors by criticality and concentrate effort on those that support critical or important functions.
- Map the program to a recognized framework, such as the GV.SC category of NIST CSF 2.0.
- Assess vendors at onboarding, monitor them continuously and reassess when something changes.
- Add AI use, software supply chain security and vulnerability handling to your vendor questionnaires.
- Report third-party risk to the board in the terms regulators use: NIS2 Article 20, DORA Article 28 and SEC Item 106.
Some of these pressures are troubling. Most, however, point toward more resilient risk management practices, supported by automation, integration and modern platforms. Learn how Centraleyes approaches vendor risk management.