One Vendor Breach, Five Victims: Why Exposure Management and TPRM Are Now the Same Problem

Here’s the number from this year I can’t stop thinking about: every vendor breach in 2025 hit an average of 5.28 downstream organizations. That’s the highest figure on record, and roughly double the year before.

Add the Verizon DBIR finding that 48% of breaches now involve a third party, and you get the theme that ran through the Gartner Security & Risk Management Summit in London: exposure management is complicated. Really complicated. And it isn’t something you can solve inside your own four walls.

AI incidents start the same old way

When the sessions broke down how AI incidents actually begin, the list was familiar:

• Perimeter exploits
• Phishing
• Third-party and supply chain compromise
• Identity abuse
• Employee misuse
• AI infrastructure
• Hijacked agentic automation

Only the last two are new. The rest are the same ways in we’ve always defended against. What AI changes is the blast radius behind them. An attacker who phishes their way into an account that has an AI agent with broad API access reaches far more than one inbox.

How AI is changing vulnerability management

Gartner described AI’s effect on vulnerability management in three waves, each needing a different response:

Two predictions made the resourcing stakes concrete: 50% of incidents will involve custom-built applications, and a third of FTE time will go to cleaning up data debt so AI can be secured. If your governance program is still only a plan on paper, those numbers will come out of your team’s capacity whether you plan for them or not.

Third parties are part of your environment

The third-party picture was the most sobering part of the week:

• About 80% of third parties are still only getting basic due diligence and periodic TPRM. Classify, tier, send a questionnaire, see you next year.
• Third parties are over-leveraged because they scale and they’re always available. The same qualities that make them valuable make them a concentrated point of failure.
• Regulators are already ahead of most programs. NIS2 wants you to look at the specific service or product within the vendor. DORA wants you to look at critical ICT. Neither one is satisfied by a vendor-level score.
• Questionnaires don’t scale on either side. Your team can’t review them fast enough, and your vendors can’t fill them out fast enough.

Three questions for every alert

The filter I took home was simple:

What is the signal? What does it mean for me? What do I do?

In practice, that means getting the right alert, not more alerts: always-on, objective visibility that moves at the speed of risk and lets you act on evidence instead of assumptions.

This is where AI earns its place. It can take a real burden off your team:

• Evidence-grounded auto-fill, so neither you nor your vendor is retyping answers that already exist in a SOC 2 report.
• Threat-informed triage, so the vendor tied to an active campaign rises to the top of the queue.
• Fourth-party mapping, so you know who your vendors depend on before their vendor gets breached.
• Always audit-ready, so evidence is collected continuously rather than gathered in a rush before the exam.

The real goal is better vendor relationships

What I appreciated most is that the conversation didn’t stop at visibility. Visibility is a means to an end. The outcomes that matter:

• Fewer high-risk vendors, not just more visibility into them
• Critical issues fixed faster, not just flagged
• Suppliers who lean in instead of shutting down
• A shift from blame to partnership

If your vendors dread hearing from your risk team, your program is producing paperwork, not risk reduction.

Siloed programs give the business contradictory advice

This brings me to the main argument. When exposure management, TPRM and GRC each keep their own inventory, run their own assessments and report separately, the business gets scattered and contradictory advice. One team says a vendor is fine; another says it’s critical. Leadership has no idea who to trust.

The direction Gartner laid out was convergence:

• Centralized third-party risk inside an integrated technology risk program
• Continuous TPRM: ongoing oversight and risk reduction, not an annual snapshot
• Threat-informed TPRM: fixing supplier security issues proactively, before they become your incident

Where SAFE fits: orchestrate the work your team already knows is wasted

In my last post I wrote about becoming an orchestrator. This is what it looks like in practice.

Every security analyst knows which parts of their week are wasted: chasing vendors for replies, copying findings into tickets, forwarding the same email to three teams. SAFE‘s Workflows module lets them hand that work to agents so they can focus on preventing the next incident. Agents can:

• Follow up with vendors and adjust decisions based on what they reply
• Email IT and post findings straight into Jira
• Escalate critical issues to the right people, not just the security team

That last point matters most. Two examples:

• Your organization’s favorite data analytics vendor just added AI, and it can now analyze all your PII, including data on Californian and European customers and partners. That’s a privacy conversation, and the privacy team needs to be part of it.
• A vendor is flagged Tier 1 because it’s business-critical, and the contract says there are no SLAs and no backup plan. That’s a BCDR conversation, and BCDR needs to be part of it.

This is how risk teams work across security and the business. Exposure management and the third-party attack surface aren’t separate problems needing separate tools. Your third parties are part of your environment. So are your fourth parties. And in a world where an AI model can find and exploit weaknesses in a platform, every one of those layers protects the business equally.

Sources:

• AI Journal – Black Kite 2026 Third-Party Breach Report press release
• SAFE – 2026 Verizon DBIR: Third-Party Risk Is Now Breach Risk