Organizations can no longer rely on traditional vendor assessments to manage cyber risk. A cyber risk specialist warned that threat actors are increasingly targeting smaller suppliers, fourth parties, and hidden dependencies, forcing firms to rethink how
The future of vendor risk management
will depend less on collecting questionnaires and more on identifying threats
before attackers do, according to a cyber risk specialist speaking at a recent
gathering of third-party risk professionals.
The senior executive, representing a
cyber risk intelligence provider, argued that organizations are spending too
much time assessing vendors through traditional methods and not enough time
actively reducing risk.
Speaking at CeFPro’s 2026 Vendor Risk
USA event in Dallas, urged firms to adopt a more intelligence-led approach that
mirrors the way threat actors identify targets and exploit weaknesses
throughout the supply chain.
The warning comes as cyber criminals
increasingly shift their focus away from direct attacks on large financial
institutions and toward the smaller organizations that support them.
Drawing on research into the
financial services supply chain, the executive explained that ransomware groups
have become highly sophisticated operations that function much like commercial
enterprises. Their objective is simple: identify the easiest route to a
successful attack and maximize the likelihood of payment.
"Their focus has shifted to the
third party and to the nth party purposely to go after financial
services," he said. "They're targeting the weakest link in the
chain."
One of the most significant changes
in recent years has been the profile of organizations being targeted.
Whereas threat actors previously
focused on companies with revenues between $50 million and $100 million, they
are now increasingly targeting businesses generating less than $20 million
annually.
These firms often have weaker
controls, fewer resources, and less regulatory scrutiny.
More importantly, they may have no
obligation to publicly disclose cyber incidents.
"The big one is, they have no
regulatory or legal obligation to disclose they've been breached," the
speaker noted. "Then law enforcement never finds out."
That trend has profound implications
for financial institutions. While many banks and financial firms have
significantly improved their own cyber defenses, their vendor ecosystems
continue to expand.
Third parties increasingly rely on
fourth parties, which themselves depend on fifth parties and beyond, creating
layers of interconnected risk that are often poorly understood.
According to the speaker, threat
actors have recognized this imbalance. Financial institutions have become
harder targets, so attackers are exploiting weaknesses elsewhere in the supply
chain.
Research presented during the session
found that many commonly used vendors maintain generally strong overall cyber
posture scores. However, beneath those headline figures, substantial weaknesses
often remain.
