Third-party risk is now half the breach problem
Verizon’s 2026 Data Breach Investigations Report found that breaches with third-party involvement rose 60% year over year, “reaching 48% of total breaches” (Verizon 2026 DBIR summary). A year earlier, the 2025 DBIR reported that third-party involvement had “doubled to 30%” (Verizon).
Most security teams still assess vendors the same way: send a questionnaire, collect a SOC 2 report, file both, and repeat next year. That process does not scale to hundreds of vendors, and it rarely checks whether the evidence actually supports the answers.
This guide covers the 2026 regulatory pressure on third-party risk, why questionnaires alone fall short, and how AI vendor risk assessment can review vendor evidence faster without removing human judgment.
For assessing the AI systems you build or deploy, using NIST AI RMF and ISO/IEC 42001, see AI Risk Assessment and AI GRC: Frameworks, Laws and Controls for 2026.
The 2026 regulatory picture for third-party risk
US regulators share one message: you can outsource a service, but not the responsibility for its risk.
| Framework | Who it affects | What it expects on third parties |
|---|---|---|
| SEC Regulation S-K Item 106 | Public companies | Disclose “whether the registrant has processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider” |
| SEC Regulation S-P amendments | Broker-dealers, investment advisers and other covered institutions | Oversight of service providers “through due diligence and monitoring”; providers notify within 72 hours of a breach. Compliance dates: December 3, 2025 (larger) and June 3, 2026 (smaller) |
| Interagency Guidance on Third-Party Relationships | Banks (Fed, FDIC, OCC) | Life-cycle risk management; using third parties “does not diminish its responsibility” |
| NIST CSF 2.0, GV.SC | Any organization using CSF | Due diligence before contracting (GV.SC-06) and risks “assessed, responded to, and monitored over the course of the relationship” (GV.SC-07) |
| NYDFS guidance on third-party service providers | NY-regulated financial entities | ”Covered Entities may not delegate responsibility”; recommends contract terms on whether data “may be used to train AI models” |
Two trends stand out. First, the time frames are shrinking: Reg S-P’s 72-hour vendor notification and the SEC’s four-business-day 8-K window for material incidents (SEC) leave little room for slow vendor discovery. Second, AI itself is now a third-party risk. NYDFS’s October 2025 letter asks firms to address vendors’ AI use in contracts, and the NIST AI RMF calls for policies covering “AI risks and benefits arising from third-party software and data” (NIST AI RMF).
Why questionnaires alone fall short
Questionnaires collect claims. Evidence proves them. The gap between the two is where third-party risk hides.
- Visibility is thin. In an Imprivata/Ponemon study, 47% of organizations had a breach or attack involving third-party network access in the past 12 months, and “only 50% said that they have a comprehensive inventory of all third parties with access to their network” (Imprivata/Ponemon).
- Basic controls are missing. Verizon found that “only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication” (Verizon 2026 DBIR summary).
- Regulators expect evidence review. The interagency guidance suggests banks “may consider reviewing System and Organization Control (SOC) reports” and check that their scope and results “are relevant to the activity to be performed” (Federal Register). NYDFS likewise points to “security attestations (e.g., SOC2, ISO 27001)” for reassessments (NYDFS).
Two different jobs: answering vs. assessing
The market often blurs two separate workflows:
| Seller-side questionnaire answering | Buyer-side evidence assessment | |
|---|---|---|
| Who does it | Your sales engineering or security team, for customers | Your TPRM, security or procurement team, for vendors |
| Input | Incoming questionnaire + your knowledge base | Vendor’s SOC 2 report, ISO 27001 certificate, policies, pen test summary |
| Goal | Answer fast and consistently | Decide whether the vendor’s controls are adequate for your use |
| Key risk | Inaccurate answers | Accepting claims the evidence does not support |
AI vendor risk assessment, in the sense of this guide, is the buyer-side job: reading what vendors send you and testing it against your requirements.
How AI vendor risk assessment works
Gartner notes that “Many vendors are incorporating machine learning and AI to support automated assessment and analysis,” and adds a condition: “With appropriate disclosures and human review, embedded AI will be a competitive differentiator” (Gartner). A sound AI-assisted workflow looks like this:
- Define the requirement set. Pick the controls that matter for this vendor’s service and data: for example NIST CSF 2.0 categories, your security policy, or contract clauses.
- Ingest the evidence. SOC 2 Type II reports, ISO 27001 certificates and Statements of Applicability, policies, pen test summaries and questionnaire responses.
- Map evidence to requirements. AI reads each document and links passages to the requirements they support, citing page and section.
- Flag gaps and exceptions. Missing controls, out-of-scope systems, expired reports, qualified opinions, SOC 2 exceptions and complementary user entity controls you must operate yourself.
- Human review and decision. An analyst checks each flag against the cited source, accepts or rejects it, and records the risk decision.
- Monitor over time. Re-run the assessment when new reports arrive or the vendor’s scope changes, in line with GV.SC-07’s “over the course of the relationship.”
Capabilities to require
- Source citations for every finding. If a flag cannot be traced to a page in the vendor’s evidence, it cannot be defended to an auditor.
- Scope checks. Confirm the SOC 2 or ISO 27001 scope covers the systems and locations that actually serve you.
- Configurable requirement sets. Different vendors need different control sets; one generic checklist creates noise.
- AI-specific questions. Capture whether the vendor uses AI and whether your data may train models, as NYDFS recommends.
- Audit trail. Record who accepted each finding and why.
Evaluation checklist for third-party risk management software
| Evaluation area | Ask the vendor | Red flag |
|---|---|---|
| Evidence reading | Upload a real SOC 2 Type II report; show findings with page citations | Summary score with no citations |
| Scope validation | Does it detect when the report’s scope excludes the service you buy? | Treats any SOC 2 as a pass |
| Exceptions and CUECs | Does it extract SOC 2 exceptions and complementary user entity controls? | Ignores the auditor’s exceptions section |
| Requirement sets | Can we assess against NIST CSF 2.0, our policies and contract clauses? | One fixed questionnaire for all vendors |
| Continuous monitoring | How are reassessments triggered (new report, scope change, incident)? | Annual calendar reminders only |
| AI governance | How is AI output reviewed, and is our data used for model training? | No human review step; vague data terms |
| Regulatory reporting | Can we export evidence of oversight for SEC, Reg S-P or examiner requests? | Data locked in dashboards |
Run a pilot with five vendors you already know well. If the tool finds the issues your team already knows about, and cites where, it is worth scaling.
Assess vendor evidence, not just vendor answers
AskDona is built for the buyer-side job: it reads the security evidence vendors send you, maps it to the requirements you choose, and shows the source passage behind every finding. Your analysts stay in control of every risk decision.
Try a security evidence assessment with one vendor’s SOC 2 report and see which gaps surface.
FAQ
How common are third-party breaches? Verizon’s 2026 DBIR found third-party involvement in 48% of breaches, up 60% from the prior year’s dataset (Verizon).
Is a SOC 2 report enough for vendor due diligence? It is strong evidence, but you must check that its scope and results are relevant to the service you use, as the interagency guidance notes (Federal Register).
Can AI make vendor risk decisions on its own? It should not. Gartner frames AI in TPRM as valuable “with appropriate disclosures and human review” (Gartner). AI should surface evidence and gaps; people decide.
How is AI vendor risk assessment different from security questionnaire automation? Questionnaire automation helps you answer customers. Vendor risk assessment helps you evaluate suppliers. They use similar technology for opposite sides of the same transaction.
Do public companies have to disclose third-party risk processes? Yes. SEC Item 106 asks whether the company has processes to oversee cybersecurity risks from third-party service providers (eCFR).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| Verizon: 2026 DBIR news release | Industry report | May 19, 2026 | 48% third-party involvement |
| Verizon: 2026 DBIR Executive Summary | Industry report | May 2026 | MFA remediation 23% |
| Verizon: 2025 DBIR | Industry report | Apr 23, 2025 | 30% prior year |
| eCFR: 17 CFR 229.106 | Regulation text | Current | SEC third-party disclosure |
| SEC press release 2023-139 | Regulator | Jul 26, 2023 | 8-K Item 1.05 timing |
| SEC: Regulation S-P compliance guide | Regulator | 2024 | 72-hour notice, compliance dates |
| Interagency Guidance on Third-Party Relationships | Regulator | Jun 9, 2023 | Life cycle, SOC report review |
| NIST CSF 2.0 | Standard | Feb 26, 2024 | GV.SC-06, GV.SC-07 |
| NIST AI RMF 1.0 | Standard | Jan 2023 | Third-party AI risk |
| NYDFS: Third-party service provider guidance | Regulator | Oct 21, 2025 | Non-delegable responsibility, AI training terms |
| Gartner: TPRM technology press release | Analyst | Jun 2, 2025 | AI with human review |
| Imprivata/Ponemon: Third-party access report | Survey | Feb 2025 | 47% breach, 50% inventory |