ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload

Third-party risk management research reports

Third-party risk management research covering breach case studies, continuous monitoring, and vendor exposure across the supply chain.

01 · Research report

Research report16 min read

Your System Is a Network of Other Systems

How roughly 700 OpenAI evaluation agents chained a package mirror, a stranger's test app, and 14 leaked tokens into a Hugging Face production compromise, and what that does to vendor trust built on annual attestations.

Research report14 min read

Twelve Weeks: From Acquisition to Attack

Two threat actors, two vulnerability classes, one target: what the Abbott incidents reveal about the security gap between acquired and integrated systems.

Research report3 min read

The Platform Beneath Your Vendors

One poisoned VS Code extension, one GitHub employee laptop, and 3,800 internal repositories listed for sale. This report reconstructs the TeamPCP breach chain and shows why nth-party exposure now lives below the vendor surface.

Research report4 min read

The State of Continuous Monitoring

Continuous monitoring still alerts teams after exposure but rarely helps them act. This report examines why alert-heavy programs stall, what modern vendor response requires, and where TPRM teams need deeper operational context.

Research report9 min read

The State of Third-Party Risk Management in the Age of AI

Third-party risk management was designed in the early 2000s for a different environment: fewer vendors, slower software cycles, stable relationships you could assess once and revisit annually. The assumptions baked into most programs still reflect that era. Fixed review cycles. Questionnaire-based assessments. SOC 2 reports as the primary evidence. Annual reassessments regardless of what changed. Meanwhile, the vendors themselves have changed completely. They ship code weekly. They add AI capabilities and subprocessors without disclosure. They run on shared infrastructure that creates fourth- and fifth-party dependencies invisible to anyone doing a standard assessment. A vendor's risk profile can shift materially between one annual review and the next, and nothing in the traditional TPRM workflow is designed to catch it.

Ready for agentic third-party risk and security?

Book a demo