Four in five firms have suffered a cybersecurity breach caused by a third-party vendor

Some 80 percent of organisations experienced a cybersecurity breach that originated from vulnerabilities in their vendor ecosystem in the past 12 months, and the average organisation had been breached in this way 2.7 times, according to global research into third-party cyber risk management published by BlueVoyant, a global cybersecurity services company.

The resulting report, titled “Global Insights: Supply Chain Cyber Risk–Managing Cyber Risk Across the Extended Vendor Ecosystem“, says that organisations are experiencing multiple pain points across their cyber risk management programmes as they aim to mitigate risk across a network that typically encompasses 1409 vendors.

The study was conducted by independent research organisation Opinion Matters and recorded the views and experiences of 1,505 CIOs, CISOs and chief procurement officers in organisations with more than 1,000 employees across a range of vertical sectors including business and professional services, financial services, healthcare and pharmaceutical, manufacturing, utilities and energy. It covered five countries: the US, the UK, Mexico, Switzerland and Singapore.

Other key survey findings include that 29 percent say they have no way of knowing if cyber risk emerges in a third-party vendor; fewer than a quarter (22.5 percent) monitor their entire supply chain; 32 percent reassess and report their vendor’s cyber risk position only six-monthly or less frequently; and 81 percent say that budget for third-party cyber risk management is increasing, by an average figure of 40 percent. The average headcount in internal and external cyber risk management teams is 12.

Commenting on the research findings, Jim Penrose, COO BlueVoyant, said: “That four in five organisations have experienced recent cybersecurity breaches originating in their vendor ecosystem is of huge concern.

“The research clearly indicated the reasons behind this high breach frequency: only 23 percent are monitoring all suppliers, meaning 77 percent have limited visibility and almost one-third re-assess their vendors’ cyber risk position only six-monthly or annually.

“That means in the intervening period they are effectively flying blind to risks that could emerge at any moment in the prevailing cyber threat environment.”

Pain points
Further insight into the difficulties that are leading to breaches was revealed when respondents were asked to identify the top three pain points related to their third-party cyber risk programmes in the past 12 months.

The most common problems were managing the volume of alerts generated by the programme; working with suppliers to improve security performance; and prioritising which risks are urgent and which are not.

However, overall responses were almost equally spread across 13 different areas of concern. In response to these issues, budgets for third-party cyber risk programmes are set to rise in the coming year. Some 81 percent of survey respondents said they expect to see budgets increase, by 40 percent on average.

Penrose said: “The fact that cyber risk management professionals are reporting difficulties across the board shows the complexity they face in trying to improve performance. It is encouraging that budget is being committed to tackling the problem, but with so many issues to solve many organisations will find it hard to know where to start.

“Certainly, the current approach is not working, so simply trying to do more of the same will not shift the dial on third-party cyber risk.”

Analysis of the responses from different commercial sectors revealed considerable variations in their experiences of third-party cyber risk. The business services sector is suffering the highest rate of breaches, with 89 percent saying they had been breached via a weakness in a third party in the past 12 months.

The average number of incidents experienced in the past 12 months was also highest in this sector, at 3.6. BlueVoyant said this is partly due to the fact that firms in the sector reported working with 2,572 vendors, on average.

In contrast, only 57 percent of respondents from the manufacturing sector said they had suffered third-party cyber breaches in the past 12 months. The sector works with 1,325 vendors on average, but had a much lower breach frequency, at 1.7. Thirteen percent of respondents from the manufacturing sector also reported having no pain points in their third-party cyber risk management programmes, a percentage more than twice as high as any other sector.

Commenting on the stark differences observed between sectors, Penrose said: “This underlines that there is no one-size-fits-all solution to managing third-party cyber risk.

“Different industries have different needs and are at varying stages of maturity in their cyber risk management programmes. This must be factored into attempts to improve performance so that investment is directed where it has the greatest impact.”

The survey investigated the tools organisations have in place to implement third-party cyber risk management and found a mix of approaches, with no single approach dominating.

Many organisations are evolving towards a data-driven strategy, with supplier risk data and analytics in use by 40 percent. However, static, point-in-time tactics such as on-site audits and supplier questionnaires remain common.

Penrose concluded: “Overall the research findings indicate a situation where the large scale of vendor ecosystems and the fast-changing threat environment are defeating attempts to effectively manage third-party cyber risk in a meaningful way.

“Visibility into such a large and heterogenous group of vendors is obscured due to lack of resources and a continuing reliance on manual, point-in-time processes, meaning real-time emerging cyber risk is invisible for much of the time.

“For organisations to make meaningful progress in managing third-party cyber risk and reduce the current concerning rate of breaches, they need to be pursuing greater visibility across their vendor ecosystem and achieving better context around alerts so they can be prioritised, triaged and quickly remediated with suppliers.”