Think about every company your business relies on. Your payroll software. Your cloud storage. The IT tools your team uses every day. Each one of those relationships is also a potential entry point for attackers. And the numbers suggest most businesses aren’t treating them that way.
A 2025 survey of over 500 IT leaders found that 71% of organizations dealt with at least one material third-party security incident over the past year. Five percent reported ten or more. Let that sink in for a second.
It is not a rare edge case anymore. Third-party involvement in breaches has roughly doubled in recent years, growing from about 15% to nearly 30% of all incidents. That trajectory should make any business owner uncomfortable, regardless of their size.
The root cause is not hard to understand. Modern businesses depend on enormous webs of vendors, SaaS platforms, software libraries, and service providers to keep the lights on. Every integration, every API connection, every login credential shared with a partner is a potential gap. Attackers know this. Many of them have shifted their strategy specifically because of it.
Here is what makes supply chain attacks so effective: they abuse trust. When your systems grant a third-party tool access to your data, they are trusting that tool is clean. If the tool has been compromised, that trust becomes a liability.
Recent campaigns targeting widely used business platforms have shown how a single weak link can cascade across industries. In some cases, attackers didn’t need to break through any defenses at all. They simply abused OAuth credentials or over-permissioned integrations to log in as legitimate users. You can review the warning signs of these kinds of vendor-level risks in more detail here, but the short version is this: if you’ve granted access, you’ve accepted risk.
This is why third-party risk management isn’t just an IT checkbox. It is a core part of your security posture.
Beyond the vendors your team interacts with every day, there is another layer of risk hiding inside the software your developers and IT team actually build or deploy. Most modern applications pull in dozens of open-source packages. Those packages pull in other packages. And in many organizations, nobody is keeping a close eye on what is actually running under the hood.
Attackers have started targeting this layer directly. They plant malicious code in popular public repositories, disguising it as useful packages. Once a developer installs one of these packages, the malicious code can harvest credentials, open backdoors, or enable downstream supply chain breaches.
The 2020 SolarWinds attack was a wake-up call for this exact problem. A compromised software build pipeline meant every customer downstream inherited the risk automatically. Five years later, organizations are still struggling with the same patch management gaps and misconfigured pipelines that made that breach possible.
Software Bills of Materials, often called SBOMs, are one of the tools that can help here. An SBOM is essentially a complete inventory of everything your software is built from. They are being pushed by regulators including CISA and are now required under the EU Cybersecurity Resilience Act. But adoption is still slow across the industry, and most organizations are not treating SBOMs as living documents that get updated alongside their software.
One of the biggest findings from recent research on this topic is how little visibility most organizations actually have into their extended supply chains. Only about one in five organizations said that at least half of their supply chain was covered by some form of cybersecurity program. Only about a quarter have worked incident response into their third-party risk plans at all.
That gap between risk and readiness is where most incidents happen. Assessments and compliance checklists give you a snapshot, but they do not give you ongoing visibility into what your vendors are doing after they pass the initial review. If you have not already done a formal cybersecurity assessment that includes your third-party relationships, that is a good place to start.
The problem compounds when you factor in how quickly vendor ecosystems change. A SaaS tool your team added last quarter might have broader data access than you realize. A partner company that passed your security review two years ago may have new vulnerabilities today. Visibility has to be continuous, not periodic.
Fixing third-party risk is not a single project. It is an ongoing discipline. But there are some practical starting points that make a real difference.
First, stop treating vendor reviews as a one-time event. Require ongoing evidence of security controls, not just a signed questionnaire. Ask vendors for proof that they are running multi-factor authentication, endpoint detection, and logging. Build audit rights into your contracts so you have recourse if something changes.
Second, map your SaaS footprint honestly. Many organizations are surprised to find out how many tools have access to their data. SaaS sprawl is a real problem and it directly expands your third-party attack surface.
Third, get serious about your software dependencies. If your team deploys code, you need a process for vetting open-source packages and keeping tabs on what is actually running in your environment. SBOMs help. So does setting clear security expectations for any partner or vendor involved in software development.
Finally, make sure your incident response plan specifically accounts for third-party scenarios. If a vendor gets breached, do you know how to detect it? Do you know who to call? Those are questions worth answering before you need them.
No business is going to stop using third-party software or outside service providers. That ship has sailed. But the organizations that manage this well are the ones that treat their vendor relationships as an extension of their own security perimeter. Not something separate. Not someone else’s problem.
The good news is that visibility is achievable. Controls are deployable. And the steps to reduce third-party risk are well understood. If you want to figure out where your organization stands today, reach out to Gibraltar Solutions to start that conversation.
