Third party risk management in 2026 amounts to a $15B annual market, with the typical enterprise running 500-2000 third party relationships, with the third party risk program trying to assess the security of each one. The program produces 100-500 page reports per vendor per year, the reports sit in the procurement folder, the breaches from the third parties keep happening. The honest guide covers what works, what does not work, and what to actually do.
The SolarWinds breach in 2020 was the moment the third party risk problem became the C suite problem. The MOVEit breach in 2023 was the moment the third party risk problem became the regulator problem. The 2025 Snowflake credential theft was the moment the third party risk problem became the operational problem. The 2026 state of the third party risk amounts to a state where the third party risk has moved from the procurement folder to the executive dashboard, the program has not kept up with the shift, the program still produces the 100-500 page reports nobody reads.
What the typical TPRM program looks like
Three characteristics, in roughly that order of how often they appear. The first runs as the questionnaire problem, where the enterprise sends the vendor a 500 question security questionnaire, the vendor fills it out, the enterprise reviews the answers, the enterprise approves the vendor. The questionnaire amounts to the the document nobody reads in full. The second runs as the certification problem, where the enterprise requires the vendor to have a SOC 2, an ISO 27001, a PCI DSS, the vendor has the certification, the enterprise accepts the certification. The certification. the the document that ran accurate 6 months ago. The third runs as the continuous monitoring problem, where the enterprise subscribes to a continuous monitoring service (the SecurityScorecard, the Bitsight, the UpGuard), the service scores the vendor, the enterprise tracks the score, the score drops, the enterprise does not act on the drop. The three characteristics together produce the typical TPRM program.
What the typical enterprise has tried
Three approaches, in roughly that order of how often they have failed. The first runs as the centralisation approach, where the enterprise builds the central TPRM team, the central team handles all the vendors, the central team becomes the bottleneck, the vendor onboarding slows to a crawl. The second runs as the tiering approach, where the enterprise tiers the vendors by criticality, the critical vendors get the thorough review, the non critical vendors get the questionnaire, the tiering is what the tiering the enterprise decided in 2018 and has not updated since. The third runs as the contract clause approach, where the enterprise puts the security requirements in the contract, the contract gets signed, the enterprise does not enforce the contract, the contract , the the document that ran strong in 2020. The three approaches together produce the failure pattern that the typical enterprise has not escaped.
How to actually do it
Three moves if you are running the TPRM program in 2026. Prioritise the third parties by what they can do, because the third party with the access to the customer data, the production system, the credentials, runs as the third party that matters. The third party with the access to the marketing data, the office supplies, the travel booking, runs as the third party that does not. The prioritisation without the access analysis amounts to a list of vendors the enterprise cannot act on. Build the continuous monitoring into the contract, because the third party that does not agree to the continuous monitoring is essentially the the third party the enterprise cannot assess. The third party that agrees to the continuous monitoring runs as the third party the enterprise can assess. Treat the third party breach as the your breach, because the third party breach becomes the your breach when the regulator investigates, when the customer asks, when the press writes the story. The enterprise that prioritises by access, builds the monitoring into the contract, and treats the third party breach as the your breach stands as the enterprise that gets the TPRM program working.
The bottom line
Third party risk management in 2026 amounts to a $15B annual problem that has not been solved. The three characteristics of the typical program (questionnaire, certification, continuous monitoring) do not produce the security. The three failed approaches (centralisation, tiering, contract clauses) do not solve the problem. The enterprise that prioritises by access, builds the monitoring into the contract, and treats the third party breach as the your breach stands as the enterprise that gets the TPRM program working.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
