Continuous vendor monitoring means watching a vendor’s external security signals all year, instead of relying on one questionnaire and certificate review every twelve months. The gap between annual audits is a period of unmanaged exposure. This post compares the two models and checks what DORA, NIS2 and US bank guidance actually say.
| 17 January 2025 date from which DORA applies across EU Member States (Regulation (EU) 2022/2554, Article 64) | 364 days of blindness an annual audit creates between formal vendor reviews | At least annually ENISA expects a NIS2 supplier registry to be reviewed, or sooner when significant changes occur | June 2023 US interagency guidance says ongoing monitoring may be periodic or continuous and scales with risk |
Continuous vendor monitoring answers a problem that most TPRM programs have not formally admitted. A vendor assessment ends, and the next one begins months later. The time in between is not managed risk. It is unmanaged exposure. And in 2026, that gap is where most vendor-related breaches actually happen.
The annual audit model was built for a different threat environment. Vendor ecosystems were small, change was slow, and breaches were rare. In that world, a once-a-year questionnaire and a certification review gave a fair picture of a vendor’s security posture. Those assumptions have not held for years. Vendor ecosystems keep growing. Vendors often take time to tell their customers about their own incidents. And the main rules for vendor risk in 2026, DORA and NIS2, have moved away from annual attestation. They now expect continuous evidence of oversight.
Annual audits are not a risk management program. They are a documentation program. The difference matters. Documentation is what survives a regulatory audit. Risk management is what prevents the breach that the regulatory audit is designed to find after the fact.
What Do Annual Vendor Audits Actually Measure?
A standard vendor security assessment collects a few kinds of information. These are a completed security questionnaire and proof of relevant certifications (SOC 2 Type II, ISO 27001, PCI DSS). They also include penetration test summaries and sometimes a right-to-audit clause that is rarely used. Each of these has a basic limit. The TPRM field talks about that limit at length in research papers. It admits it far less often when it designs real programs.
Questionnaires Measure What Vendors Say, Not What Vendors Do
The questionnaire is the basic tool of vendor risk management. It is also entirely self-reported. A vendor filling one in reports its stated policies, its intended controls and its current certifications. It is not reporting its real security posture at that moment. A questionnaire has no way to check that the stated policy is actually in place.
The gap between stated policy and real posture is well documented. In the AT&T case, the vendor had to destroy customer data on a set schedule under its contract. The annual oversight cycle did not check that the vendor had actually done this. Regulators investigated after a breach. They found that the data had never been destroyed. They also found that AT&T had not enforced the deletion rule and had not monitored the vendor’s compliance. The FCC fine was $13 million. The questionnaire for that engagement almost certainly showed satisfactory data handling.
Source: FCC enforcement action against AT&T, 2024; $13M settlement for vendor cloud breach affecting 8.9 million customers
Certifications Measure Controls at a Point in Time
A SOC 2 Type II report covers a set audit period, usually six or twelve months. It is not a real-time check of security posture. It is evidence that certain controls were in place and working during the audit window. A company may get a clean SOC 2 Type II report in January and then suffer a material security incident in February. That incident will not show up in its certification status until the next audit cycle begins.
This gap creates a predictable blind spot. The more mature the vendor’s compliance program, the more convincing its certification papers look. The time since the last audit also keeps growing. A vendor with strong compliance may be breached in month two of its SOC 2 audit cycle. It will carry a clean certification for the next ten months while the breach goes undetected.
The Fundamental Mismatch
Annual assessments produce a snapshot. Vendor risk is a movie. A company that reviews a vendor once a year is watching one frame of a twelve-month film. It uses that frame to draw conclusions about everything in between. The frame it chose may be completely accurate. The rest of the film stays invisible. The gap between how often you assess and how fast risk changes is where the TPRM calendar breaks. It does not break because annual audits are done badly. It breaks because annual audits are annual, and material vendor risk changes all the time.
The Anatomy of the Gap: Where Vendor Breaches Actually Occur
Vendor-reported incidents are a slow signal. A company that relies on vendors to tell it about their security events works with a lag. There is a delay between the moment a breach hits the vendor and the moment the company learns about it.
Put a disclosure delay against a standard annual assessment cycle, and the size of the exposure window becomes clear. Say a vendor is assessed in January and is breached in February. The earliest you can expect a notice depends on how quickly the vendor finds the breach. It also depends on the vendor telling its customers at once when it does. The next formal assessment is eleven months away, in January of the following year. The company will spend more than a year with a compromised vendor relationship. It will get questionnaire answers from a vendor whose environment was already breached when it filled in the last one.
| Scenario | Timeline | Visibility Under Annual Audit Model | Visibility Under Continuous Monitoring |
| Vendor discovers breach internally | Day 0 | None | Dark web monitoring can detect exposed credentials or data soon after they appear |
| Breach data appears in underground markets | Days to weeks later, often for ransomware groups | None | Dark web monitoring alerts you when vendor-linked data shows up in threat actor channels |
| Vendor discloses to downstream customers | After the vendor’s own discovery and investigation | First notice received | Already aware; a response plan may already be under way |
| Annual assessment questionnaire completed | Month 12 | Vendor reports its current posture. A breach may have happened and been fixed in the meantime, with no record in the assessment | The assessment checks controls; continuous monitoring data adds context for the full 12-month period |
| Breach confirmed in regulatory filing or public disclosure | Varies; can be 18+ months post-incident | First formal awareness for organizations that rely on public reports | Real-time intelligence; may have been acted on months before public disclosure |
Source: vendor disclosure timing varies by incident; the timeline is illustrative
Sub-Processor Sprawl: The Change That Happens Between Questionnaires
Vendor risk does not change only through security incidents. It changes all the time through ordinary business operations that have material security effects. Examples include new sub-processors added to data processing agreements, staff changes in security-critical roles, and changes to where data is processed. Others are new integrations with third-party services and configuration changes to shared infrastructure.
Vendor sub-processor lists change often between reviews. An annual questionnaire asking ‘who are your sub-processors?’ captures an answer for one moment. That answer is almost certain to be outdated before the next assessment cycle begins.
Cascade Effects: One Breach, Multiple Victims
The blast radius of a vendor breach has grown a lot as vendor ecosystems have become more concentrated. The Identity Theft Resource Center’s H1 2026 report documented 38 supply chain attacks. They produced 280.6 million victim notices across 206 organizations. That is an average of 5.28 organizations per supply chain attack and 7.4 million victim notices per incident.
In theory, each of those 206 affected organizations had a vendor risk management program. Most had assessed the breached vendor at some point. The assessment did not stop the cascade, because the cascade began with a breach in the gap between assessments. The assessment told them the vendor was acceptable at the moment of review. It said nothing about what happened afterward.
Source: Identity Theft Resource Center H1 2026 Supply Chain Risk Report
The Questionnaire Illusion: Why More Questions Do Not Close the Gap
The usual response to poor vendor risk visibility is to send better questionnaires. Longer ones. More frequent ones. Ones with more specific control requirements. The evidence suggests this fixes the wrong problem.
Questionnaires now cover vendor ecosystems more broadly and in more detail, yet third-party incidents keep happening. More questions do not fix a timing problem.
The questionnaire cannot close the gap, because the gap is about time, not information. The problem is not that companies lack information about a vendor’s security posture at the moment of assessment. The problem is that the posture at that moment is not the same as the posture at every other moment in the assessment cycle.
What Questionnaires Cannot Detect
| Risk Category | Example | Detectable by Annual Questionnaire? | Detectable by Continuous Monitoring? |
| Credential exposure | Vendor employee credentials appearing in infostealer logs or dark web markets | No: it happens after the assessment and is not self-reported | Yes: dark web monitoring can detect exposure soon after it occurs |
| New sub-processor addition | Vendor adds an AI data processor or offshore subcontractor without formal notice | No: sub-processor pages update without triggering assessment reviews | Yes: continuous sub-processor page monitoring detects changes in near real-time |
| Ransomware targeting | Vendor’s name or infrastructure appears in threat actor targeting discussions before an attack | No: threat actor channel activity is not assessed in questionnaires | Yes: threat intelligence monitoring surfaces signs of targeting before the attack |
| Infrastructure exposure change | Vendor’s cloud misconfiguration creates new internet-facing exposure | No: external posture changes between assessment cycles | Yes: continuous external attack surface monitoring of vendor infrastructure |
| Staff attrition in security roles | Vendor’s CISO or security team leaves after completing the questionnaire | No: personnel changes are not tracked between assessments | Partial: news monitoring and LinkedIn tracking can surface material leadership changes |
| Financial distress | Vendor’s weak finances cut security spending before the distress is disclosed | No: financial information is not routinely checked between assessments | Partial: financial health signals (news, credit ratings, public filings) can be tracked all the time |
| Regulatory action | Vendor receives a regulatory notice or fine during the assessment cycle | No: regulatory actions occur between assessments | Yes: regulatory action monitoring and news intelligence surface material events |
Many TPRM Programs Are Driven by Compliance, Not Risk Reduction
Many TPRM programs are built around compliance, not risk reduction. This explains why the questionnaire model lasts. Questionnaires produce the documents that satisfy auditors and regulators. They do not produce the real-time intelligence that lowers the chance of a breach. A company that adds more questionnaires but ignores the gap between assessments improves its compliance papers. Its real exposure stays largely the same.
The Scale Problem: Many Vendors, Few People, 12 Months
Even if annual questionnaires were perfectly accurate, the staffing math of many TPRM programs makes full coverage very hard. Vendor inventories are often large, and the teams that manage them are often small.
In a small team, each vendor gets only a few working days a year under annual assessments. That time has to cover the first review, questionnaire analysis, follow-up, tracking of fixes, and records for regulators. It leaves no room for any monitoring between assessments.
| The Capacity Calculation Take a hypothetical program with 300 vendors and 2 TPRM FTEs: 300 / 2 = 150 vendor relationships per person. 260 working days per year / 150 vendors = about 1.7 days per vendor per year. For a tier-1 critical vendor, that 1.7 days covers questionnaire review, certification checks, finding review and all the paperwork. There is no budget left for monitoring between assessments. The annual model is not just a hassle for the organization. For most TPRM teams, it is the most that staffing allows. This is why continuous monitoring cannot be added as extra human workload. It must come as automated intelligence that surfaces signals worth acting on. It cannot depend on manual review of every vendor all the time. |
The Risk-Based Monitoring Tier Model
The answer to the scale problem is not equal continuous monitoring for all vendors. It is monitoring at an intensity matched to risk tier, applied to a vendor inventory that is kept up to date.
| Tier | Vendor Profile | Monitoring Intensity | Assessment Cadence |
| Tier 1: Critical | Direct access to critical systems, sensitive data processing, single points of failure (cloud infrastructure, identity providers, payment processors) | 24/7 automated monitoring: dark web credential watch, external attack surface, threat intelligence, news and regulatory alerts | Semi-annual formal assessment plus event-driven reassessment triggered by monitoring alerts |
| Tier 2: High | Regular access to sensitive data, built into production systems, big business impact if unavailable | Continuous automated monitoring: external security posture, dark web, news. Weekly digest reporting. | Annual formal assessment plus event-driven reassessment |
| Tier 3: Medium | Occasional data access, non-critical integrations, replaceable within 30 days | Automated monitoring: security posture changes, major security incidents, public breach disclosures. Monthly digest. | Annual questionnaire with less depth; no site visit or follow-up unless monitoring raises an alert |
| Tier 4: Low | No sensitive data access, no system integration, commodity service | Automated monitoring: public breach disclosures, major regulatory actions. Quarterly digest. | Lightweight annual questionnaire; self-attestation acceptable |
The Regulatory Shift: DORA, NIS2, and OCC Now Require Continuous Evidence
What regulators expect for vendor oversight has moved clearly away from annual attestation. Three major frameworks active in 2026 either require continuous monitoring or strongly signal it. In each case the enforcement posture is no longer about remediation. Regulators are issuing penalties.
- June 2023US interagency guidance on third-party relationshipsIssued by the OCC, Federal Reserve Board and FDIC.
- 17 January 2025DORA appliesDirectly applicable across EU Member States.
- June 2025ENISA technical implementation guidanceWritten for entities covered by Implementing Regulation (EU) 2024/2690.
DORA: Active Enforcement Since January 2025
The Digital Operational Resilience Act applies to EU financial entities and, through contract terms, to their ICT service providers worldwide. DORA is not a framework. It is a directly applicable EU regulation that entered enforcement in January 2025. DORA leaves penalties for financial entities to the Member States. They must give their authorities the power to apply administrative penalties and remedial measures (Article 50). Critical ICT third-party providers can face periodic penalty payments of up to 1% of their average daily worldwide turnover (Article 35(8)).
DORA’s third-party risk rules under Articles 28 through 44 include a mandatory Register of Information. This is a live, regularly updated list of every ICT third-party arrangement that supports critical or important functions. The register must be sent to national regulators every year. The 2026 submission cycle closed in March 2026, and regulators are actively auditing for gaps. A register built from spreadsheets put together once a year does not meet the continuous updating that DORA’s framework implies.
Above all, DORA requires financial entities to monitor ICT third-party providers on an ongoing basis, not on an annual review schedule. The wording requires ongoing assessment of the provider’s security posture, performance and compliance. Continuous monitoring needs a different operating model from the one most programs were built around.
Source: DORA Regulation (EU) 2022/2554; EIOPA supervisory guidance 2025; penalties per Articles 35(8) and 50
NIS2: Supply Chain Security Is an Explicit Requirement
NIS2 applies across 18 sectors covering essential and important entities. Supply chain security is an explicit NIS2 requirement: covered entities must assess and manage the security risks posed by their suppliers and service providers. ENISA’s technical implementation guidance was published in June 2025 for entities covered by Implementing Regulation (EU) 2024/2690. It expects them to keep a registry of direct suppliers and service providers up to date. It also expects them to review it at least annually or when significant changes occur.
GDPR, NIS2 and DORA now set overlapping duties that are each enforced on their own, and they apply to the same vendor relationships. Some companies believed that meeting one framework’s annual assessment rule covered the others. They are now finding that each framework has its own continuous monitoring expectation and its own enforcement authority.
Source:NIS2 Directive (EU) 2022/2555; ENISA implementation guidance June 2025
OCC and Federal Reserve: Continuous Monitoring as Expectation
US banking regulators, including the OCC, Federal Reserve and FDIC, have steadily tightened what they expect from third-party risk management. The June 2023 interagency guidance expects ongoing monitoring throughout a third-party relationship, matched to its risk and complexity. The guidance says this monitoring may be conducted on a periodic or continuous basis. More comprehensive or frequent monitoring is appropriate for higher-risk activities, including critical activities. Financial institutions that rely only on annual assessments for critical vendors face examination findings and remediation requirements. These go beyond fixing a single vendor to program-level deficiencies.
| The Regulatory Convergence Signal GDPR, NIS2, DORA and US federal banking guidance all point to the same expectation: ongoing, demonstrable oversight of vendor security posture, not point-in-time papers from the annual assessment cycle. Three independently enforced regulatory frameworks now agree on this. The expectation has moved from best practice to compliance floor. A tool that refreshes its view of a vendor once a year cannot produce the continuous evidence that DORA and NIS2 require. It does not matter how detailed the annual report looks on the day it is made. |
What Does Continuous Vendor Monitoring Look Like in Practice?
Continuous vendor monitoring is not continuous assessment. It is not sending the same questionnaire every month instead of every year. Continuous monitoring is the automated, ongoing observation of vendor security signals that exist outside the vendor’s own self-reporting. It is paired with event-driven triggers that start a formal assessment when signals point to a material change in risk.
The Six Monitoring Channels
| Channel | What It Monitors | Signal Type | Alert Trigger |
| Dark web and credential monitoring | Vendor email domains, admin credentials and company identifiers that show up in infostealer logs, dark web markets and threat actor channels | Exposed vendor credentials create a direct access risk to your environment if the vendor has privileged access | Any appearance of critical vendor credentials in dark web markets; threshold-based alerts for less critical vendors |
| External attack surface monitoring | The vendor’s internet-facing infrastructure: IP ranges, domain portfolio, certificates, cloud misconfigurations, exposed databases and unpatched external systems | The vendor’s external posture directly affects breach odds; a newly exposed database or unpatched internet-facing system is an immediate risk | New high-severity findings; critical CVE in confirmed vendor technology stack; exposed data or credentials |
| Sub-processor and data flow monitoring | Changes to vendor privacy policies, sub-processor lists, data processing agreements and published security documents | A new sub-processor may route your data through a party you have not assessed; privacy policy changes may alter how data is kept and accessed | Any sub-processor list change; data location changes; removal of security commitments from published documents |
| Breach intelligence monitoring | Vendor appearances in breach notification databases, ransomware victim trackers and regulatory enforcement records | Outside confirmation of a vendor security incident or regulatory action, typically much earlier than direct vendor notice | Any confirmed vendor name in breach notification databases; ransomware victim publications; regulatory enforcement actions |
| Threat actor targeting intelligence | Underground forum talk, threat actor channel posts and dark web messages that mention specific vendor names, technologies or sectors | Early signs that a vendor is being targeted before exploitation begins | Vendor name appearing in threat actor targeting talk; sector-specific campaigns matching the vendor profile |
| Financial and operational intelligence | News monitoring, public financial filings, credit rating changes and executive departure announcements | Financial distress cuts security spending; leadership changes in security-critical roles affect program continuity | Material financial distress signals; CISO or security leadership departure; major regulatory fine |
Event-Driven Assessment vs. Calendar-Driven Assessment
The biggest operational change in a continuous monitoring model is the shift from calendar-driven to event-driven formal assessments. Annual assessments happen because twelve months have passed. Event-driven assessments happen because something changed.
Take a Tier 1 vendor with a clean monitoring profile. An event-driven model may mean less formal assessment work than the annual model. No material change in the monitoring data means no reason for a formal reassessment before the annual review. Now take a Tier 1 vendor whose monitoring shows a credential exposure, a new critical CVE in its technology stack and a leadership change within three months. The event-driven model escalates at once. It is not a note in a folder that gets looked at in the next annual cycle.
This is the concrete operational advantage of continuous vendor monitoring over annual assessment. It matches assessment effort to real changes in risk. It does not spread effort evenly across time whether or not the risk profile has changed.
The Exposure Window
For third-party breaches, the time a vendor takes to find and disclose an incident, plus the investigation time after notice, can produce exposure windows that run for months. Continuous monitoring does not promise to catch every vendor breach at once. But it shortens the exposure window a great deal for the signals that can be seen from outside. These are credentials in dark web markets, ransomware victim publications, external infrastructure changes and threat actor targeting. These signals exist whether or not the vendor chooses to disclose the breach. They are the evidence that bridges the gap between the vendor knowing and its customers knowing.
The Transition Roadmap: From Annual Audit to Continuous TPRM
Moving from an annual audit model to continuous vendor monitoring does not mean replacing the existing assessment program. It means extending it with external intelligence that works in the gaps the assessment cannot cover. It also means changing assessment triggers so that they respond to intelligence signals, not to calendar dates.
Phase 1: Vendor Inventory Completion and Risk Tiering (Months 1-2)
Most TPRM programs have incomplete vendor inventories. Many companies believe they have a full vendor list until they run a structured discovery exercise. Then they find vendors that business units onboarded informally. They find shadow IT deployments that have become de facto vendors. They also find vendor relationships inherited through acquisitions. Continuous monitoring needs a complete starting inventory, because gaps in the vendor list mean gaps in monitoring coverage.
Base risk tiering on four factors. The first is sensitivity: what data the vendor processes or can reach. The second is criticality: what systems or functions would be disrupted if the vendor was unavailable. The third is replaceability: how long it would realistically take to find a substitute if the relationship had to end. The fourth is access depth: what direct path leads from the vendor’s environment to your assets. The tier drives monitoring intensity and assessment cadence for the rest of the program.
Phase 2: Baseline Establishment and Monitoring Deployment (Months 2-4)
Deploying continuous monitoring across the whole vendor inventory sets a baseline risk profile for every vendor. The baseline does two jobs. It records the starting posture at the moment monitoring begins, which gives the reference point for spotting change. It also often turns up existing issues that the annual assessment cycle had missed.
Companies that deploy continuous monitoring across a vendor ecosystem for the first time consistently find exposure they did not know about. Examples are vendor credentials already circulating in dark web markets, external infrastructure misconfigurations that have existed for months, and sub-processor relationships that were never disclosed in formal assessments. The baseline deployment is often the first time a company gets an accurate picture of its third-party risk exposure.
Phase 3: Alert Triage Integration and Response Playbook Development (Months 3-5)
Continuous monitoring generates alerts. The way a monitoring program usually fails is alert fatigue. Too many low-value signals teach the team to ignore monitoring output, and that defeats the purpose of the program. Alert quality matters more than alert volume.
Effective continuous monitoring programs define alert severity tiers and response playbooks before deployment. A credential exposure alert for a Tier 1 vendor with privileged access should trigger a different response than the same alert for a Tier 4 low-risk vendor. For the Tier 1 vendor the response is immediate contact, access review and escalation to the CISO. For the Tier 4 vendor it is documented and reviewed at the next scheduled touchpoint. The playbook decides whether the monitoring investment becomes risk reduction or just more documentation.
Phase 4: Assessment Calendar Restructuring (Months 4-6)
Once monitoring is running and alert triage is in place, the annual assessment calendar can be restructured to reflect real changes in risk. Tier 1 vendors move to semi-annual formal assessments, backed by event-driven triggers. Tier 3 and Tier 4 vendors may move to lighter self-attestation. Monitoring coverage then provides the ongoing oversight that the old annual questionnaire cycle was supposed to provide.
The total number of assessments often falls in this phase, because event-driven triggers are more precise than calendar triggers. Fewer assessments are done, but each one answers a specific risk signal, not the passage of time. Assessment effort goes where the monitoring data shows risk has changed. It is not spread evenly across a fixed schedule.
What Are the Concrete Benefits of Continuous Vendor Monitoring?
| Benefit | Annual Audit Baseline | Continuous Monitoring Outcome |
| Breach detection speed | Depends on vendor disclosure or discovery at the next assessment | Dark web signals can be detected soon after exposure; signs of targeting before an attack can give weeks of warning |
| Sub-processor visibility | Point-in-time snapshot that may be outdated within days of completion | Real-time alerts on sub-processor page changes; changes detected before the next assessment cycle |
| Regulatory evidence | Annual assessment documents; gap between assessment date and current state | Continuous audit trail of monitoring activity; timestamped evidence of ongoing oversight that satisfies DORA and NIS2 requirements |
| Assessment effort allocation | Even spread across the annual cycle whether or not risk has changed | Focused on vendors with material risk signals; less overhead for stable, low-signal vendors |
| Vendor fatigue | Every vendor gets the same annual questionnaire regardless of risk | Fewer questionnaires for low-risk stable vendors; monitoring coverage makes up for less frequent formal assessment |
| Fourth-party risk | Not systematically addressed in most annual assessment programs | Monitoring can extend to known sub-processors and fourth-party dependencies of critical vendors |
| Financial and operational risk | Captured only if raised in the questionnaire; financial health not systematically tracked between reviews | Continuous news and public filing monitoring surfaces financial distress signals before they turn into operational impact |
How Brandefense Delivers Continuous Vendor Monitoring
Brandefense brings the intelligence signals that continuous vendor monitoring needs into one platform. The platform covers the outside observation channels that annual assessments cannot reach. The monitoring runs all the time and does not need manual review of every signal. Alerts reach the TPRM team when a material change in risk is detected. The full monitoring record gives the timestamped evidence of ongoing oversight that regulatory frameworks require.
| Capability | Coverage |
| Dark web credential surveillance | Watches for vendor email domains, admin credentials and company identifiers in dark web markets, infostealer logs and threat actor channels. Gives early warning of credential exposure before the vendor tells you |
| External attack surface monitoring for vendor ecosystem | Continuously scans internet-facing infrastructure tied to vendor domains and IP ranges. Detects new exposures, certificate expirations, configuration changes and unpatched vulnerabilities in vendor external infrastructure |
| Threat actor targeting intelligence | Watches underground forums and threat actor channels for mentions of vendor names, vendor-used technologies and campaign targeting profiles that match the vendor’s sector and size. Surfaces early signs of an attack |
| Breach intelligence monitoring | Tracks vendor appearances in breach notification databases, ransomware victim publications and regulatory enforcement records. In many cases it gives earlier awareness than direct vendor notice |
| Regulatory evidence and documentation | Creates timestamped monitoring records suitable for DORA Register of Information submissions, NIS2 oversight documentation and OCC/Federal Reserve examination evidence |
| Risk-tiered alert routing | Alert severity and routing are set to match your tier structure. High-priority vendor alerts escalate at once. Lower-tier signals are grouped into periodic digest reports to reduce the workload |
RELATED READING
One Vendor, Eleven Crises: The TPRM People Data Blind Spot : how a single shared HR assessment platform reached eleven organizations at once, and what annual programs miss in vendor categories that hold behavioral data. Read the post on the people data blind spot in TPRM
Merger, Acquisition, Forgotten Domain : how M&A activity expands vendor and attack surface simultaneously, compounding the annual audit gap with inherited unknown assets Read the post on M&A attack surface and due diligence
NIS2 and DORA Compliance for TPRM : the specific regulatory obligations that now require continuous evidence of vendor oversight rather than annual snapshots. Read the post on NIS2 and DORA third-party risk management
62% of Breaches Now Start With a Vendor : the statistical context for why vendor risk has become the primary attack surface for impactful cyber incidents Read the post on the rise of supply chain cyber attacks
If you need the questions themselves, the free vendor risk questionnaire template pairs a scored questionnaire with the external signals you can check between reviews.
