[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Third-Party Risk Management](/category/third-party-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [47% of Breaches Involve Vendors: Is Your TPRM Ready?](/blog/the-state-of-third-party-access-in-cybersecurity) Publish date May 27, 2025 {x} minute read # 47% of Breaches Involve Vendors: Is Your TPRM Ready? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Organizations are still struggling to manage vendor-related cyber risk effectively. [According to a recent study by Imprivata and the Ponemon Institute](https://www.imprivata.com/uk/company/press/over-half-uk-organisations-experienced-security-breach-resulting-third-party-access), nearly half of organizations fall victim to data breaches involving third-party network access. This isn't just another statistic. It's a critical cybersecurity issue hinting at broader limitations of traditional TPRM programs. This article dissects the latest findings on the state of Third-Party Risk Management, underscoring the urgency of a new approach to reducing third-party risk exposure. ## Decoding the state of TPRM: Key Insights from the 2025 Ponemon report The 2025 Ponemon Report paints a sobering picture of the risks associated with third-party access. Excessive privileged access granted to third parties was a significant factor, identified as the direct cause in 34% of breaches.  Adding to this concern, 35% of respondents whose organizations were breached admitted uncertainty about whether over-privileged access was a primary cause**, **highlighting a critical lack of visibility into vendor activities potentially involving sensitive company data. The aftermath of these preventable security failures is severe and multifaceted: * 53% of impacted organizations suffered loss or theft of sensitive and confidential information * 50% were imposed regulatory fines * 41% sustained business disruptions by needing to discontinue the relationship with the implicated third-party vendor > As a result of these experiences, 48% of organizations now view third-party remote access as the weakest aspect of their attack surface.  These challenges show no signs of subsiding. A substantial 64% of survey respondents expect third-party-related breaches to either increase or remain at their current high levels over the next 12-14 months.  Beyond the immediate operational disruption and reputational damage, the financial toll is also considerable, with the average cost to restore access after an incident (factoring in detection, response, and recovery) averaging** **at $88,000. A significant contributing factor to response costs is the immense strain on internal resources: IT and security personnel spend an average of 134 hours every week investigating third-party and privileged access risks. ## Why current TPRM approaches are failing to survive For CISOs, the responsibility extends beyond implementing a TPRM program to also ensuring its ongoing success. The Ponemon Report's findings indicate that when it comes to managing third-party risk, many current approaches aren't just faltering, they’re failing to detect critical third-party risks that could facilitate a large-scale breach.  This widespread ineffectiveness is often rooted in foundational deficiencies within current TPRM approaches. 58% of organizations admit they don't have a strategy for securing third-party access that is consistently applied across the enterprise. Furthermore, only half of the organizations surveyed have a comprehensive inventory of all third-party access to their network, a standard requirement of even the most basic TPRM program. This fundamental lack of visibility means many organizations are likely underestimating their actual third-party risk exposure, which may explain the concerning level of implicit trust being placed on vendors.  The Ponemon Report reveals that 55% of organizations do not evaluate the security and privacy practices of third parties before engaging in a business relationship requiring access to sensitive information. This critical oversight in due diligence persists even after access is granted, as 59% of organizations then fail to monitor third-party access to sensitive information, a figure that, alarmingly, has increased from 50% in 2022.  Ultimately, a TPRM program that cannot effectively see its vendors, understand their access privileges, or consistently apply security strategies is not just underperforming; it's failing to meet the basic requirements for survival in the modern threat landscape. ## Critical weaknesses threatening TPRM program viability The path to effective TPRM is often paved with significant challenges, as the Ponemon Report reveals critical chokepoints threatening program survival. Chief among these are: * A fundamental lack of oversight or governance (50%) * The complexity of compliance and regulatory requirements (48%), and * Insufficient assessment of risks (40%) These findings shed light on a concerning trend: Almost half of TPRM programs struggle with essential Vendor Risk Management requirements, making them ill-equipped to face the upcoming wave of intensifying third-party risk complexity, an inevitability being rushed forward by the increasing adoption of AI technology by third-party vendors. These alarming statistics often reflect deep-seated insufficiencies within traditional TPRM processes themselves, likely due to ongoing dependence on inefficient manual tasks, such as spreadsheets for managing questionnaires and manually reviewing extensive vendor security documentation to track compliance. Manually reviewing evidence for compliance isn’t just time-consuming and inefficient, it also makes it incredibly challenging to consistently and accurately map findings to diverse compliance controls, which likely explains why almost half of respondents to this survey have an inflated perception of the complexity of meeting regulatory requirements.  ## Future-proofing your TPRM: AI-powered strategies for survival and resilience Can traditional TPRM approaches survive tomorrow's high-stakes world of third-party risk mitigation?  Not without a fundamental shift from reactive, manual processes to proactive, AI-driven vigilance.  With the recent integration of AI technology into the TPRM model, workflow efficiencies have been elevated to levels never seen before. Now, with the support of advanced intelligence, tens of thousands of vendor documents can be scanned and analyzed for control evidence in minutes, and stakeholder-ready risk assessments can be generated in just 60 seconds. For security teams fighting for survival amidst resource shortages (a barrier for 41% of organizations), this isn't just an efficiency gain; it's a lifeline that could reclaim the 134 hours a week currently spent manually evaluating third-party risks. [UpGuard is leading this next phase of TPRM evolution](https://www.upguard.com/product/vendorrisk/ai) by leveraging AI technology to tackle the root causes of TPRM failure—critical visibility gaps and manual overload, producing a platform that makes TPRM faster, smarter, and less of a daily burden. Passive, check-box TPRM is a gamble CISOs can no longer afford. A proactive, AI-driven approach is essential for transforming your TPRM from a resource drain into a strategic security function, which is fundamental to not just surviving but thriving in a complex modern vendor risk landscape. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [PHP2Shell Is a Vendor Problem Too: How to Find and Close Third-Party Exposure](/blog/php2shell-third-party-exposure) Your vendors run PHP too. Here’s how to find which ones are exposed to PHP2Shell and prove they’ve patched, using scanning and a vendor questionnaire. [](/team/cassy-van-eeden) [Cassy van Eeden](#) November 2, 2026 Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Third-Party Risk Management #### [Ongoing TPRM Success: Continuous Security Monitoring with AI](/blog/continuous-security-monitoring-with-ai) Is manual work weighing down your security team and limiting your ability to scale? Learn how UpGuard and its AI features can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) September 29, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)