For CISOs and cyber risk leaders, third-party risk is no longer a governance exercise—it is an operational reality that directly impacts security posture, business resilience, and decision-making.
Authors:
Nick Sanna
President, SAFE Security | Founder, FAIR Institute
Alexander Antukh
CISO, Aboitiz Power | Board Member, FAIR Institute
Today’s enterprise is not just interconnected—it is interdependent. Your environment now includes:
The rapid adoption of generative AI platforms such as ChatGPT, Claude, and Gemini has fundamentally changed the nature of third-party risk.
These are not static vendors. They are dynamic systems that:
As a result, the core question for cyber leaders has shifted:
Not: “Are our vendors compliant?”
But: “Do we have continuous control over the risk introduced by our extended—and increasingly AI-driven—ecosystem?”
Answering that requires rethinking how third-party risk management (TPRM) actually works.
TPRM has evolved through five generations. Most organizations operate across multiple generations simultaneously—creating fragmentation and limiting effectiveness.
The starting point for most programs.
Characteristics:
CISO reality:
You can demonstrate diligence—but not control.
This model answers: “Did we check the box?”
It does not answer: “Are we exposed right now?”
To scale operations, organizations moved into GRC-based platforms.
Characteristics:
CISO reality:
Efficiency improves—but risk understanding does not.
You have better process visibility, but still lack:
The shift toward external signals and real-time data.
Characteristics:
CISO reality:
You now have more data than ever—but not necessarily better decisions.
You are managing:
Key problem: Without linking signals to business impact, you cannot prioritize effectively.
A major step forward—introducing business context.
Characteristics:
CISO reality:
For the first time, you can:
But limitations remain:
This is where TPRM becomes operationally aligned with how risk actually behaves.
Characteristics:
And critically for the AI era:
CISO reality:
This is the first model that allows you to:
For cyber leaders, this evolution is not theoretical—it is driven by four hard realities:
You are no longer managing dozens of vendors—but thousands.
And now:
Manual and periodic models simply cannot keep up.
Risk is no longer episodic. It changes continuously through:
If your assessments are point-in-time, your understanding is outdated the moment it’s produced.
AI introduces risks that traditional TPRM was never designed to handle:
Unlike traditional vendors, AI systems are:
Persistent, adaptive risk surfaces
Which means:
Your risk management must be equally continuous and adaptive.
CISOs are now expected to:
This is no longer about reporting—it is about operating risk management as a core business function.
To operate effectively in this new environment, CISOs and risk leaders should be able to answer:
Visibility
Do we have a real-time, enterprise-wide view of third-party risk—including AI usage?
Materiality
Can we quantify the business impact of our most critical vendor and AI dependencies?
AI Risk Exposure
Where are AI systems embedded in our workflows—and what risks do they introduce?
Data Governance
What data is being shared with AI vendors—and how is it controlled?
Continuous Control
Are we monitoring configuration, behavior, and usage—not just compliance?
Scalability
Can we scale risk management alongside vendor growth and AI adoption—without scaling cost and complexity?
At its core, the evolution of TPRM reflects a deeper transformation in cybersecurity:
For CISOs, this is not just a tooling shift—it is an operating model shift.
Third-party risk is no longer a supporting function. It is a primary driver of enterprise risk exposure.
The rise of AI has accelerated this transformation:
Traditional TPRM approaches were not built for this reality.
Going forward, the defining capability of leading cyber organizations will be:
The ability to continuously understand, quantify, and manage risk across an extended, AI-driven ecosystem.
The question for CISOs is no longer whether third-party risk is important.
It is:
Are we operating a model that can keep up with how risk actually behaves today?
Interact with your professional peers in redefining cyber risk management. Join us with a FAIR Institute Individual Membership.
