Third-Party Risk Management
Per-vendor TPRM, concentration risk across the vendor portfolio, AI-specific vendor evaluation. The standing discipline that runs in the background between incidents — paired with the Someone Else's Breach cluster for incident response.
- 2of 6
The 5 Vendors You Should Actually Worry About (And the 50 You Shouldn't)
The four-tier framework for identifying critical vendors, plus the portfolio-concentration angle per-vendor tiering misses — grounded in Verizon 2025 DBIR, IBM 2024, and the July 2024 BCBS third-party principles.
Read - 3of 6
Why Enterprise Clients Are Asking Small Vendors About Security
The vendor risk management trend that's changing how small businesses sell to big ones.
Read - 4of 6
How to Evaluate AI in a Vendor's Product: What to Ask Before You Buy
Your vendor added AI. The questions to ask about data handling, model behavior, and vendor claims. Plus which answers should stop the purchase.
Read - 5of 6
Vendor Concentration Risk: The Dimension Per-Vendor TPRM Misses
37 of your 142 vendors run on us-east-1. Per-vendor TPRM never sees it. The four layers of concentration risk and the matrix that maps cascading-failure exposure.
Read - 6of 6
TPRM Software: 2026 Buyer's Guide
Compare Third-Party Risk Management software for 2026 — six platforms across the platform-augmented, outside-in continuous rating, and enterprise TPRM tiers. Vendor tiering, questionnaire automation (SIG, CAIQ), continuous monitoring (SecurityScorecard, BitSight), and where each platform actually fits.
Read
Ready to put this into practice?
See how vCISO Lite operationalizes the methodology behind this series.