BlueVoyant Research Reveals Four in Five Firms Have Suffered a Cybersecurity Breach Caused By a Third-Party Vendor

Large vendor ecosystems and low visibility are increasing third-party cyber risk

NEW YORK,Sept. 23,2020 --BlueVoyant,a global,expert-driven cybersecurity services company,today released the findings of its global research into third-party cyber risk management. The study reveals that 80% of organizations surveyed experienced a cybersecurity breach that originated from vulnerabilities in their vendor ecosystem in the past 12 months,and the average respondent's organization had been breached in this way 2.7 times. The research also found organizations are experiencing multiple pain points across their cyber risk management program as they aim to mitigate risk across a network that typically encompasses 1409 vendors.

The study was conducted by independent research organization Opinion Matters and recorded the views and experiences of 1505 CIOs,CISOs and Chief Procurement Officers in organizations with more than 1000 employees across a range of vertical sectors including business and professional services,financial services,healthcare and pharmaceutical,manufacturing,utilities and energy. It covered five countries: USA,UK,Mexico,Switzerland and Singapore.

Other key survey findings include:

29% say they have no way of knowing if cyber risk emerges in a third-party vendor

Fewer than one-quarter (22.5%) monitor their entire supply chain

32% only re-assess and report their vendor's cyber risk position either six-monthly or less frequently

The average headcount in internal and external cyber risk management teams is 12

81% say that budget for third-party cyber risk management is increasing,by an average figure of 40%

Commenting on the research findings,Jim Penrose,COO BlueVoyant,said: "That four in five organizations have experienced recent cybersecurity breaches originating in their vendor ecosystem is of huge concern. The research clearly indicated the reasons behind this high breach frequency: only 23% are monitoring all suppliers,meaning 77% have limited visibility and almost one-third only re-assess their vendors' cyber risk position six-monthly or annually. That means in the intervening period they are effectively flying blind to risks that could emerge at any moment in the prevailing cyber threat environment."

Multiple pain points exist in third-party cyber risk programs as budgets rise in response

Further insight into the difficulties that are leading to breaches was revealed when respondents were asked to identify the top three pain points related to their third-party cyber risk programs,in the past 12 months. The most common problems were:

Managing the volume of alerts generated by the program;

Working with suppliers to improve security performance; and

Prioritizing which risks are urgent and which are not.

However,overall responses were almost equally spread across thirteen different areas of concern. In response to these issues,budgets for third-party cyber risk programs are set to rise in the coming year. 81% of survey respondents said they expect to see budgets increase,by 40% on average.

Jim Penrose continues: "The fact that cyber risk management professionals are reporting difficulties across the board shows the complexity they face in trying to improve performance. It is encouraging that budget is being committed to tackling the problem,but with so many issues to solve many organizations will find it hard to know where to start. Certainly,the current approach is not working,so simply trying to do more of the same will not shift the dial on third-party cyber risk."

Variation across industry sectors

Analysis of the responses from different commercial sectors revealed considerable variations in their experiences of third-party cyber risk. The business services sector is suffering the highest rate of breaches,with 89% saying they have been breached via a weakness in a third-party in the past 12 months. The average number of incidents experienced in the past 12 months was also highest in this sector,at 3.6. This is undoubtedly partly down to the fact that firms in the sector reported working with 2572 vendors,on average.

In contrast,only 57% of respondents from the manufacturing sector said they had suffered third-party cyber breaches in the past 12 months. The sector works with 1325 vendors on average,but had a much lower breach frequency,at 1.7. Thirteen percent of respondents from the manufacturing sector also reported having no pain points in their third-party cyber risk management programs,a percentage more than twice as high as any other sector.

Commenting on the stark differences observed between sectors,Jim Penrose said: "This underlines that there is no one-size-fits-all solution to managing third-party cyber risk. Different industries have different needs and are at varying stages of maturity in their cyber risk management programs. This must be factored into attempts to improve performance so that investment is directed where it has the greatest impact."

Mix of tools and tactics in play

The survey investigated the tools organizations have in place to implement third-party cyber risk management and found a mix of approaches with no single approach dominating. Many organizations are evolving towards a data-driven strategy,with supplier risk data and analytics in use by 40%. However static,point-in-time tactics such as on-site audits and supplier questionnaires remain common.

Jim Penrose concludes:

"Overall the research findings indicate a situation where the large scale of vendor ecosystems and the fast-changing threat environment is defeating attempts to effectively manage third-party cyber risk in a meaningful way. Visibility into such a large and heterogenous group of vendors is obscured due to lack of resources and a continuing reliance on manual,point-in-time processes,meaning real-time emerging cyber risk is invisible for much of the time.

"For organizations to make meaningful progress in managing third-party cyber risk and reduce the current concerning rate of breaches,they need to be pursuing greater visibility across their vendor ecosystem and achieving better context around alerts so they can be prioritized,triaged and quickly remediated with suppliers."

The full global BlueVoyant research report: "Global Insights: Supply Chain Cyber Risk – Managing Cyber Risk Across the Extended Vendor Ecosystem," including analysis across countries and vertical sectors,is available here.

About BlueVoyant

BlueVoyant is an expert-driven cybersecurity services company whose mission is to proactively defend organizations of all sizes against today's constant,sophisticated attackers and advanced threats. Led by CEO Jim Rosenthal,BlueVoyant's highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency,Federal Bureau of Investigation,Unit 8200 and GCHQ,together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives and former Government cyber officials and headquartered in New York City,BlueVoyant has offices in Maryland,Tel Aviv,San Francisco,London and Latin America.

Press Contacts:

Danielle Ostrovsky

C8 Consulting (USA)

T: +1-410-302-9459

E: danielle@c8consulting.co.uk

Jim Pople

C8 Consulting (EMEA)

T: +44 7955 030191

E: jim@c8consulting.co.uk