TPRM & Vendor Risk Articles

Real-world breach analysis, third-party risk management strategy, and GRC compliance insights from the security community. Learn from the incidents that shaped modern vendor risk programs.

April 15, 2026 Strategy

The Future of Third-Party Risk Management: Trends Shaping TPRM in 2026 and Beyond

Eight trends transforming vendor risk management, from AI-powered analysis and continuous monitoring to SBOM requirements and open-source democratization.

Read article →
April 1, 2026 Strategy

How Small Security Teams Can Build an Effective TPRM Program with Zero Budget

A practical step-by-step guide for 1-3 person security teams to build a vendor risk program using free tools and smart prioritization.

Read article →
March 20, 2026 Framework

Breach Notification and Your Vendors: What They Owe You and What to Put in Contracts

SEC, GDPR, and HIPAA notification requirements, plus the contract clauses every TPRM program needs for vendor breach obligations.

Read article →
March 5, 2026 Framework

NIST AI Risk Management Framework: Managing Third-Party AI Risk in Your Vendor Portfolio

As vendors adopt AI, organizations need to assess AI-specific risks. How to incorporate NIST AI RMF into your TPRM program.

Read article →
February 10, 2026 Strategy

Open-Source TPRM: Why Free Software is Democratizing Vendor Risk Management

Commercial TPRM tools price out SMBs. Open-source alternatives are closing the gap with transparency, data sovereignty, and zero licensing fees.

Read article →
January 18, 2026 Breach Analysis

The True Cost of a Third-Party Breach: $4.8 Million and Rising

IBM data shows third-party breaches cost 12% more than internal ones. The hidden costs of vendor incidents and why prevention is cheaper.

Read article →
December 15, 2025 Breach Analysis

SolarWinds Five Years Later: What Changed in Third-Party Risk Management?

A retrospective on the improvements and persistent gaps in vendor risk management since the SUNBURST attack.

Read article →
December 8, 2025 Framework

FAIR Risk Quantification: Putting a Dollar Amount on Third-Party Risk

Why qualitative H/M/L ratings fail and how FAIR methodology converts vendor risk into Annualized Loss Expectancy that boards understand.

Read article →
October 20, 2025 Strategy

Beyond Adversarial Assessments: Building Vendor Relationships That Actually Reduce Risk

Why treating vendors as partners instead of adversaries leads to better security outcomes, with practical collaborative TPRM approaches.

Read article →
August 12, 2025 Framework

Security Rating Services: What Works, What Doesn't, and What's Next for TPRM

An honest assessment of SRS platforms, their strengths and limitations, and how to combine them with other TPRM controls.

Read article →
June 5, 2025 Strategy

Fourth-Party Risk and Technology Concentration: The Hidden Threat in Your Vendor Portfolio

When all your vendors share the same cloud provider, one failure cascades everywhere. How to identify and manage concentration risk.

Read article →
April 10, 2025 Strategy

Why Continuous Vendor Monitoring Beats Annual Questionnaires Every Time

Annual reviews create 364-day blind spots. Continuous monitoring with Security Rating Services provides real-time vendor risk visibility.

Read article →
February 15, 2025 Strategy

Why Questionnaire-Only TPRM is Broken, Obsolete, and Ineffective

Only 4% of organizations trust questionnaire accuracy. Why point-in-time self-reported assessments fail and what to do instead.

Read article →
August 20, 2024 Breach Analysis

AT&T Data Breach: 110 Million Customer Records Exposed Through a Third-Party Cloud Platform

How credential stuffing against Snowflake led to the exposure of nearly all AT&T cellular customer call and text metadata.

Read article →
August 5, 2024 Strategy

CrowdStrike Outage: The $5.4 Billion Lesson in Vendor Concentration Risk

A faulty software update crashed 8.5 million systems worldwide, exposing the dangers of single-vendor dependency in critical infrastructure.

Read article →
July 15, 2024 Breach Analysis

Snowflake Customer Breaches: How Credential Stuffing at One Cloud Vendor Exposed 165+ Organizations

Ticketmaster, AT&T, Santander, and 160+ others breached through stolen credentials and missing MFA on Snowflake accounts.

Read article →
April 8, 2024 Breach Analysis

Change Healthcare: The Largest Healthcare Data Breach in History — 190 Million Records

ALPHV/BlackCat ransomware hit a UnitedHealth subsidiary, disrupting healthcare nationwide and costing $2+ billion in response.

Read article →
November 10, 2023 Breach Analysis

Okta's Second Breach in Two Years: When Your Identity Vendor Keeps Getting Compromised

All Okta support customers affected after attackers stole session tokens. BeyondTrust and Cloudflare detected it before Okta did.

Read article →
July 20, 2023 Breach Analysis

MOVEit Transfer: How Cl0p Ransomware Exploited One Vendor to Breach 2,700+ Organizations

A single SQL injection vulnerability in a file transfer tool led to the largest mass-exploitation event in history.

Read article →
July 15, 2023 Breach Analysis

Barracuda ESG: The Zero-Day So Severe the Vendor Told Customers to Throw Away Their Hardware

Chinese APT persistence survived firmware updates, forcing an unprecedented recommendation to physically replace compromised appliances.

Read article →
April 12, 2023 Breach Analysis

3CX Supply Chain Attack: The First Known Case of One Supply Chain Attack Causing Another

North Korean hackers compromised Trading Technologies, which infected a 3CX employee, which trojanized the 3CX app used by 600,000+ companies.

Read article →
March 15, 2023 Breach Analysis

LastPass Breach: A Supply Chain Attack That Led to $150 Million in Cryptocurrency Theft

A third-party media software vulnerability on a DevOps engineer's home computer led to encrypted vault theft and massive crypto losses.

Read article →
October 20, 2022 Breach Analysis

Uber's 2022 Breach: How an 18-Year-Old Social-Engineered Past MFA Using a Third-Party Contractor

Stolen contractor credentials and MFA fatigue gave an attacker full access to Uber's internal systems, Slack, and HackerOne reports.

Read article →
April 5, 2022 Breach Analysis

Okta and Lapsus$: When Your Identity Vendor Gets Breached

A third-party support contractor compromise exposed 366 Okta customers and raised questions about identity provider supply chain risk.

Read article →
January 8, 2022 Framework

Log4Shell: The Open-Source Dependency That Put Every Vendor at Risk

A CVSS 10.0 vulnerability in Apache Log4j exposed millions of applications and highlighted the hidden risk of transitive software dependencies.

Read article →
July 15, 2021 Breach Analysis

Kaseya VSA Attack: How REvil Ransomware Hit 1,500 Businesses Through One Vendor

REvil exploited a zero-day in Kaseya's VSA platform, cascading ransomware through MSPs to 800-1,500 downstream businesses.

Read article →
June 10, 2021 Breach Analysis

Colonial Pipeline: When Vendor Risk Meets Critical Infrastructure

DarkSide ransomware shut down 5,500 miles of pipeline for 6 days via compromised VPN credentials, causing gas shortages across the US East Coast.

Read article →
March 20, 2021 Breach Analysis

Microsoft Exchange Server Hack: Hafnium and the 30,000 Organizations at Risk

Chinese state-sponsored hackers exploited four zero-days in on-premises Exchange Server, compromising 250,000 organizations globally.

Read article →
March 1, 2021 Breach Analysis

Accellion FTA: How Zero-Day Vulnerabilities in a File Transfer Vendor Exposed 100+ Organizations

FIN11/Cl0p chained four zero-days in Accellion's legacy file transfer appliance to steal data from Kroger, Singtel, and dozens more.

Read article →
January 15, 2021 Breach Analysis

SolarWinds SUNBURST: The Supply Chain Attack That Changed Everything

Russian intelligence inserted a backdoor into Orion updates, compromising 18,000+ organizations including US government agencies for 9+ months.

Read article →
October 8, 2020 Breach Analysis

Blackbaud Ransomware: How a Cloud Vendor Breach Hit Hundreds of Universities and Nonprofits

A CRM vendor breach affected 400+ organizations, followed by misleading disclosures that led to SEC charges and a $49.5M settlement.

Read article →
August 8, 2019 Breach Analysis

Capital One Breach: How a Cloud Misconfiguration Exposed 106 Million Records

A former AWS engineer exploited a misconfigured WAF to steal 106 million credit applications, resulting in an $80M fine and $190M settlement.

Read article →
July 25, 2019 Breach Analysis

Quest Diagnostics and AMCA: When Your Billing Vendor Exposes 20 Million Patient Records

An 8-month breach at billing vendor AMCA exposed 20 million Quest patients and bankrupted the vendor within months.

Read article →
December 10, 2018 Breach Analysis

Marriott-Starwood: The $72 Million Lesson in Acquisition Due Diligence and Inherited Vendor Risk

A breach that originated in Starwood's systems in 2014 was inherited by Marriott in 2016 and discovered in 2018. 500 million guest records exposed.

Read article →
September 25, 2018 Breach Analysis

British Airways Magecart Attack: When Third-Party JavaScript Becomes a Weapon

Magecart Group 6 injected data-skimming code into BA's payment page via a modified JavaScript library, stealing 380,000+ card details.

Read article →
April 10, 2018 Breach Analysis

Facebook-Cambridge Analytica: The Third-Party Data Sharing Scandal That Changed Privacy Forever

A third-party app harvested 87 million Facebook users' data for political profiling, leading to a historic $5 billion FTC fine.

Read article →
September 20, 2017 Breach Analysis

Equifax Breach: When a Known Vulnerability Goes Unpatched

A patch was available for months. Equifax didn't apply it. 147.9 million records and a $700 million settlement later, it became the definitive patching failure case study.

Read article →
July 18, 2017 Breach Analysis

NotPetya: How a Tax Software Update Destroyed $10 Billion in Global Supply Chain Damage

Russian military malware spread via a Ukrainian tax software update, destroying IT infrastructure at Maersk, Merck, FedEx, and hundreds more.

Read article →
October 5, 2016 Breach Analysis

Yahoo Breaches: 3 Billion Accounts and the Third-Party Risk Implications for Verizon's $4.48B Acquisition

The largest breach in history — 3 billion accounts — cost Verizon a $350 million price reduction and taught the industry about inherited M&A risk.

Read article →
January 16, 2014 Breach Analysis

The Target Breach: How an HVAC Vendor Became the Biggest Third-Party Risk Lesson in History

Stolen HVAC vendor credentials led to 110 million compromised records and $200+ million in costs. The incident that launched modern TPRM.

Read article →