Cyber exposures: third-party risk in a hyperconnected world

April 2026  |  COVER STORY | RISK MANAGEMENT

Financier Worldwide Magazine

April 2026 Issue

Today’s digital age is defined by a maelstrom of possibilities and opportunities – a hyperconnected world in which expanding services delivered through third‑party relationships enable organisations to grow and make specific business processes more accessible and efficient.

Such hyperconnectivity involves organisations, particularly multinationals, engaging with tens of thousands or even hundreds of thousands of third parties. These include suppliers, vendors, distributors and agents, representing a broad array of partners that together form a significant extended enterprise.

“Third-party transactions have become a structural feature of modern business,” concurs Mike Gillespie, chief executive and co-founder of Advent IM. “Organisations have intentionally reduced in-house capability and expanded their reliance on external partners for core functions such as IT operations, cloud hosting, cyber security, human resources systems and specialised technical expertise.”

This shift has been driven by cost pressures, the need for agility and the desire to access skills that are scarce or difficult to maintain internally. As a result, many organisations now operate within large, interconnected digital ecosystems in which critical functions rely on suppliers and their own subcontractors.

“Data, workloads and business processes routinely flow across multiple tiers of providers,” adds Mr Gillespie. “In many cases, organisations no longer own or directly control significant parts of the infrastructure that keeps them running. Third-party ecosystems are now so embedded that they form the operational backbone of the modern enterprise.”

Stephen Boyer, founder and chief innovation officer at Bitsight, notes that organisations increasingly focus on their core mission while leveraging others to provide specialist tools. “Digitally, no organisation can operate completely independently,” he says. “Consumers of one service provide services to many others, who themselves provide to many others, and so forth, creating global supply chain dependency.”

Such connectivity and dependency inevitably bring significant risk. In Gartner’s analysis in ‘Third-Party Risk Management (TPRM): An Essential Guide’, with third‑party networks continuing to expand, 40 percent of compliance leaders surveyed indicated that between 11 and 40 percent of their third parties present high risk.

“The biggest risk in hyperconnected ecosystems is a lack of visibility,” suggests Ellie Hurst, commercial director at Advent IM. “Many organisations struggle to maintain a full and current picture of their suppliers, let alone the nth-party entities those suppliers rely upon. This opacity means data often moves further and faster than businesses realise, creating blind spots where vulnerabilities can accumulate unnoticed.”

Research from SecurityScorecard and the Cyentia Institute revealed that 98 percent of organisations do business with a third party that has suffered a breach. The same research also found that the average organisation maintains relationships with 11 direct third parties and hundreds more across fourth and nth tiers.

“In many cases, the risk lies in the unexpected hidden pillar: lesser-known vendors that play an outsized role in global industries, for example a niche software vendor with fewer than 50 employees that supports the majority of Fortune 500 companies,” says Mr Boyer. “A security breach at a hidden pillar could trigger widespread disruption.”

Pathways and attack types

As reliance on third parties continues to increase, organisations must understand and manage the security risks inherent in hyperconnected, multi‑partner ecosystems. These risks originate primarily from cyber and compliance exposures.

“Cyber attackers are increasingly targeting suppliers as a pathway,” affirms Ms Hurst. “When a single weak supplier has privileged access, the compromise can quickly propagate. Regulatory exposure grows in parallel, as organisations remain accountable for how their data is handled – even when processed by external parties they may never have direct contact with.

“With the rise of large cloud platforms and shared digital services, concentration risk has also become a major concern,” she continues. “When entire sectors rely on the same handful of technology providers, failures at a single point can have widespread, cascading consequences. Third-party relationships have therefore evolved into one of the leading drivers of operational, compliance and cyber security risk.”

Understanding where these risks originate is essential for effective management. Third‑party compromise frequently begins with routine operational activities, such as software updates or system integrations, that inadvertently introduce vulnerabilities. Attackers often focus on tools or services that sit deep within organisational networks, as these can offer broad and often unmonitored access. In many cases, suppliers hold administrative privileges or maintain remote connections long after their original purpose has expired, creating attractive entry points for threat actors.

These risks manifest in numerous ways. Software supply chain attacks exploit compromised updates or components provided by third parties. Data breaches occur when vendors with inadequate security controls experience incidents that expose information. Credential theft arises when attackers use compromised login details obtained through third‑party systems. Phishing and social engineering campaigns frequently exploit trusted vendor relationships to mislead employees and gain unauthorised access. As digital ecosystems grow more interconnected, the pathways for exploitation become more varied, making proactive risk assessment and diligent oversight increasingly important.

Public sector security issues

An often overlooked dimension of third party cyber risk is the role of major public sector bodies that sit at the top of supply chains. In the UK, this concern has intensified in recent years. The National Cyber Security Centre reported handling 204 “nationally significant” cyber attacks in the 12 months to August 2025, a steep rise from 89 in the previous year. The increase highlights the extent to which public bodies remain attractive targets for attackers seeking to exploit dependencies across essential national services.

“While suppliers are required to meet minimum security standards, equivalent assurance is not always demanded or demonstrated by those commissioning services,” explains Mr Gillespie. “This ‘do as I say, not as I do’ dynamic undermines trust and resilience across entire ecosystems. True third-party assurance must start at the top of the supply chain if systemic risk is to be meaningfully reduced.”

The public sector’s unique combination of legacy systems, complex procurement arrangements and large volumes of sensitive data further magnifies the challenge. When central departments or critical national agencies fail to maintain robust oversight, cyber weaknesses can cascade rapidly across the private organisations that depend on them. This interconnectedness means that improving public sector cyber maturity has become integral to enhancing national resilience, prompting increasing debate about whether current assurance mechanisms remain fit for purpose.

Strengthening organisational culture

While technology, governance and supplier oversight remain central to reducing third party cyber risk, the internal culture of an organisation is equally influential. A well‑structured technical framework cannot operate effectively without a workforce that understands its role in maintaining security across increasingly interconnected environments. As third‑party ecosystems broaden in scale and complexity, day‑to‑day decisions made by employees have a growing impact on the resilience of the wider supply chain. This creates a need for cultural alignment that extends beyond internal systems and reaches into the partnerships on which organisations depend.

A strong security culture encourages employees to consider the implications of their choices when engaging with external vendors, platforms or services. It helps ensure that staff recognise when suppliers request unnecessary access or when unfamiliar third‑party tools present potential risks. This awareness is often the first line of defence, particularly when attackers seek to exploit human behaviour rather than technical vulnerabilities. Regular training, scenario‑based exercises and clear lines of communication contribute to building confidence among employees, enabling them to escalate concerns promptly and accurately.

Moreover, leadership plays a vital role in shaping organisational attitudes. Senior teams that emphasise accountability and openness help cultivate an environment in which third‑party risk is not viewed as an external problem but a shared responsibility that spans the entire enterprise. Visible commitment from executive leaders signals that third‑party security is embedded within strategic priorities rather than treated as an ancillary compliance requirement. This approach supports greater consistency across departments and reduces the likelihood of fragmented practices developing in isolation.

Ultimately, a mature organisational culture provides a foundation that strengthens every other aspect of third party risk management. When employees understand the interconnected nature of modern digital ecosystems and appreciate the consequences of supplier‑related failures, they are better equipped to support robust decision making and contribute to long‑term resilience.

Cascading effects

Recent years provide ample evidence of how disruptions affecting a single company within the global supply chain can generate far‑reaching consequences. Bitsight’s 2025 report ‘Under the Surface: Uncovering Cyber Risk in the Global Supply Chain’ highlights several high‑profile incidents, including SolarWinds in 2020, Kaseya in 2021, PyTorch in 2022, Okta in 2023 and CrowdStrike in 2024. Each case involved attackers exploiting different pathways to compromise supply chains.

Beyond the immediate operational consequences, the financial costs of such events often reach billions of dollars. Insurance typically covers only a small proportion of total losses. These incidents also illustrate how recovery efforts can span months, as organisations attempt to re‑establish trust, validate system integrity and address regulatory scrutiny. The scale of remediation often extends far beyond the original point of compromise, affecting partners who had no direct relationship with the initial target.

“This illustrates how deeply interconnected digital ecosystems have become,” says Ms Hurst. “A failure at one point, even if brief, can generate widespread operational disruption across multiple industries. It shows how a single organisation can unintentionally act as a global single point of failure.”

The broader implication is that cyber incidents now function less as isolated technical problems and more as systemic shocks capable of affecting entire markets. As supply chains expand and become more intertwined, the likelihood that a single disruption will ripple through multiple sectors increases, making proactive oversight and coordinated response planning ever more critical.

Managing and reducing risk

Given the scale of recent cyber incidents and the threats they pose to operations, data integrity and resilience, organisations must prioritise the protection of their third‑party ecosystems.

“Building resilience starts with establishing a complete and accurate understanding of who the organisation is connected to,” says Mr Gillespie. “This begins with a comprehensive inventory of third parties, combined with clarity about what data they access and what systems they touch. Once this foundation is in place, organisations can apply meaningful due diligence, ensure contractual safeguards reflect actual risk and, critically, conduct ongoing assurance rather than relying on one-off assessments.”

The World Economic Forum’s analysis ‘5 best practices to effectively manage third-party cyber risk’ emphasises several principles. Assessing third‑party risk requires a focus on functions and data that are most critical to the business, with assessments scoped around inherent risk. Identifying inefficiencies within internal processes enables organisations to address vulnerabilities in areas such as vendor onboarding and incident response. Aligning internal and external control assessments helps ensure consistent risk management expectations. Continuous monitoring is essential, as one‑time assessments quickly become outdated. Maintaining real‑time visibility throughout the vendor lifecycle supports timely detection of emerging issues.

“Managing and reducing such risks is inherently difficult but there are steps organisations can take to mitigate,” notes Sarah Pearce, a partner at Hunton Andrews Kurth. “Preparedness is key: implementing robust third party due diligence processes is vital, as is ensuring appropriate contractual terms are in place that allow for timely notification of incidents. Generally, organisations should keep good channels of communication open with third-party providers to allow for cooperation in the event of an incident.”

Transparency and oversight

According to Mr Gillespie, the main challenge in safeguarding third‑party ecosystems lies in achieving and maintaining transparency. “Supplier lists change frequently, and procurement activities are often decentralised, making it difficult to keep oversight aligned,” he explains. “Even where first-tier suppliers are well understood, visibility often collapses beyond that point, leaving businesses blind to fourth and fifth tier relationships that may still have access to sensitive information or vital services.”

Maintaining this visibility requires sustained governance, clear lines of accountability and consistent communication between operational teams, procurement functions and senior leadership. Without these elements, organisations often struggle to track changes in supplier relationships or recognise when new risks emerge. Many enterprises also rely on legacy contract management processes that do not capture real‑time shifts in vendor behaviour, security posture or financial stability.

As supply chains grow increasingly complex, the absence of a structured and dynamic approach to oversight can allow vulnerabilities to remain undetected for long periods. Resource constraints and competing priorities further complicate efforts to sustain a mature and well governed third party risk management capability, particularly in organisations where cyber security teams are already stretched.

Enhancing preparedness

As organisations continue to rely heavily on third‑party partners, they develop dependencies over which they may have limited control or visibility – a reliance that becomes increasingly risky in a hyperconnected world marked by growing volatility, uncertainty, complexity and ambiguity.

According to Mr Gillespie, a range of trends is likely to elevate third‑party risk in the coming years. These include greater supply chain complexity, increased geopolitical scrutiny of data sovereignty, rising regulatory expectations and continued dependence on a small number of dominant technology providers.

At the same time, the global cyber security skills gap – estimated at approximately 4.8 million unfilled positions – makes it more difficult for organisations to maintain the oversight required to manage these risks effectively. “Against this backdrop, organisations need to evolve from a compliance focused, policing mindset to a more collaborative, partnership oriented approach,” contends Mr Gillespie. “Relying solely on contracts and questionnaires encourages minimum standard behaviours and limits transparency.

“A partnership model – built on shared objectives, information sharing and continuous improvement – creates stronger alignment and more resilient outcomes,” he continues. “Oversight remains essential, but it becomes part of an ongoing dialogue rather than a static legal exercise. In a fast changing risk environment, cooperation and joint ownership of security are far more effective than rigid, transactional oversight.”

As digital interdependence continues to expand, strengthening third‑party security offers organisations a chance to build greater stability across their wider ecosystems. By prioritising transparency, shared responsibility and steady, well‑governed practices, they can improve their resilience and contribute to a more dependable operating environment.

© Financier Worldwide

BY

Fraser Tennant