Ratings ranking puts SecurityScorecard first; RiskRecon winding down
Mastercard’s announced RiskRecon wind-down is treated as a migration note, leaving nine ranked services.
Stories per day · 30 days
3 RSS
Relatedcredential-abuse2data-breach2kroll2ai-agents1anthropic1bae-systems1banking1bankruptcy-courts1bitsight1brute-force1business-email-compromise1caribbean1crest1curacao1cyber-insurance1cyber-resilience1detection1email-security1
21 stories, newest first · one card per story
Stories tagged #third-party-risk
Commentary: signature email security misses fraud from trusted accounts
The essay cites Verizon’s 2026 report, with third parties in 48% of breaches, and FBI BEC losses above $3 billion.
AI evaluation agents reached organizations they were not targeting
Pillar Security counted 21 public disclosures from July to mid-October involving OpenAI, Anthropic, Google and Meta agents.
1
CREST urges ecosystem-wide cyber resilience for financial services
The October 29 whitepaper offers illustrative maturity pathways for institutions, supervisors and providers, not a new compliance standard.
1
Security questionnaires still gate deals despite weak evidence
The author cites third-party breaches rising from 15% to 30% and urges proof such as audits instead of self-reports.
1
Kroll: most people it notified were exposed via a third-party breach
Technology providers were 6% of Kroll cases but 60% of affected people; one supplier incident can spawn many insurance claims.
1
Commentary: Caribbean outages show shared-platform cyber risk
A Curaçao ransomware incident and a shared court outage hit services used by six jurisdictions, the author argues.
1
Kroll: tech-firm breaches drove most third-party victim impact
From June 2025 to June 2026, tech compromises accounted for 60% of all breach victims Kroll counted.
1
BAE Systems Cybersecurity Incident Disrupts Bankruptcy Court Operations Across the U.S.
A cybersecurity incident at BAE Systems has halted U.S. federal bankruptcy notices nationwide, with cause and data impact unconfirmed.
1
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
An opportunistic attacker used stolen credentials and a misconfigured gateway to probe a European bank.
2
The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't
About 1,000 of 1,280 AI-embedded products bypass SSO, so inherited agents escape identity governance.
6
U.S. Bank CISO says the security role keeps growing and no one can own all of it
U.S. Bank's CISO says the expanding security role requires partnerships, not one leader owning every risk.
Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach
Bitget resumed Bitcoin withdrawals after a third-party security product flaw let attackers steal $387.5M in unauthorized transfers from hot/warm wallets.
2
Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
FBI and CISA published guidance urging critical infrastructure operators to limit third-party ICS integrator access, citing a 2025 breach of a U.S. automation firm.
Bitsight connects threat intelligence and exposure monitoring across the supply chain
Bitsight made Beacon generally available, combining supply-chain exposure monitoring with MCP support to feed threat intelligence into AI workflows.
1
Scytale expands vendor risk management with AI-powered TPRM tools
Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.
2
Dental contractor set up secret account with access to 4,000 patient records then left the company
A dental practice left an unknown vendor admin account with access to 4,000 patient records active for over three years, creating HIPAA risk.
1
AdaptHealth confirms 4.1 million people exposed in July cyberattack
AdaptHealth confirmed a ShinyHunters-attributed cyberattack exposed data of 4.1 million patients via a compromised third-party contractor account.
3
Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works
Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.
Ransomware attackers are zeroing in on mid-market companies
Black Kite found mid-market firms were 73% of disclosed ransomware victims in North America and Europe from January 2023 to June 2026.
1
Recorded Future Launches 6 New Capabilities for Third-Party Risk
Recorded Future added native risk ratings to its Third-Party Risk product, uniting threat intelligence and risk scoring in one workflow.