Your vendors are your largest unmanaged risk
In 2026, the majority of significant security incidents do not start inside the organization that suffers the most damage. They start in the supply chain — a software vendor with insufficient access controls, a SaaS provider with a misconfigured API, a cloud service with a vulnerability that your security team never knew existed because the vendor's questionnaire response said "all controls are in place."
The numbers are unambiguous. According to the 2025 Verizon Data Breach Investigations Report, third-party involvement was identified in 62% of data breaches, up from 15% five years earlier. The shift to cloud, the proliferation of SaaS tools, and the increasing specialization of business functions have created a supply chain attack surface that most organizations are dramatically underequipped to manage.
The typical TPRM (Third Party Risk Management) programme in a mid-market company looks like this: a spreadsheet of 150 vendors, an annual security questionnaire sent to the 30 "critical" ones, and a risk tier assigned based on how the vendor answered the questions. It is better than nothing. It is not much better than nothing.
Why annual vendor questionnaires fail
The annual questionnaire has four structural problems that no amount of process improvement can fix:
It is a point-in-time snapshot. A vendor's security posture can change dramatically between questionnaire cycles — a breach, a change in cloud configuration, an acquisition, a key personnel departure. The questionnaire captures none of this.
It relies entirely on vendor self-reporting. Vendors have every incentive to answer questionnaires optimistically. Without independent verification, there is no way to distinguish a vendor with excellent security from a vendor with an excellent questionnaire response.
It covers only the vendors you know to ask. Most vendor inventories are incomplete. Shadow IT — SaaS tools procured without formal vendor onboarding — represents a significant and largely invisible risk surface.
It creates false assurance. A completed questionnaire in a spreadsheet looks like a managed risk. It may represent an unmanaged one with a paper audit trail.
What automated TPRM looks like in practice
An automated vendor risk management platform replaces the annual questionnaire cycle with continuous, multi-dimensional risk assessment. Here is how it works in GRCEye:
Vendor inventory and classification
Every vendor is catalogued in the platform with their services, data access scope, integration type, and contract details. Risk tiers are assigned automatically based on configurable criteria: vendors with access to customer PII are Critical; vendors providing non-integrated productivity tools are Low. The inventory is maintained continuously — new vendors are onboarded through a structured workflow, and the platform alerts when contracts are expiring or when vendor data needs review.
AI contract review
When a new vendor contract is uploaded to the platform, the AI reads the document and performs a clause-by-clause analysis against your standard contract requirements. It flags:
- Missing security obligations (no right-to-audit clause, no breach notification timeline, no subprocessor restrictions)
- Non-standard or risky clauses (liability caps below your exposure, one-sided termination rights, insufficient data residency commitments)
- Gaps between what the contract says and what your vendor policy requires
The AI generates a summary report with a risk score and a list of recommended negotiation points. A lawyer or procurement manager reviews the output — the AI does not negotiate contracts, but it ensures that no contract goes unread and no risky clause goes unnoticed.
In practice, this changes the contract review workflow from "contracts are reviewed when legal has time" to "every contract is reviewed within 24 hours of upload, and the risk is documented before signing."
Six-dimension risk cartography
Each vendor in the platform is assessed across six risk dimensions:
- Cybersecurity posture — questionnaire responses, independent monitoring signals, certification status
- Financial stability — credit risk indicators and publicly available financial data
- Regulatory compliance — GDPR processor compliance, NIS2 supply chain obligations, relevant certifications
- Operational dependency — what happens to your operations if this vendor is unavailable for 24 hours, 72 hours, or longer
- Data exposure — volume and sensitivity of data the vendor can access
- Geographic and geopolitical risk — data residency, jurisdiction of incorporation, geopolitical exposure
The six-dimension cartography produces a visual risk map that shows, at a glance, where your vendor portfolio's risks are concentrated. A CFO can see immediately that your critical data exposure is concentrated in three vendors — and ask the right questions about those specific relationships.
CISO approval workflow
When a vendor contract is ready to proceed after AI review, the platform routes it through a configurable approval workflow. The CISO (or designated approver) reviews the AI risk summary, the identified contract issues, and the remediation plan before approving the vendor for onboarding. The approval is logged with the approver's identity and timestamp — a complete audit trail for regulatory purposes.
This workflow ensures that no vendor is onboarded without a documented risk decision — and it does so without requiring the CISO to read every contract in full.
The business case: three numbers CEOs should know
€4.5M average cost of a third-party breach (IBM Cost of a Data Breach 2025, adjusted for EU mid-market companies). This is the number that makes vendor risk management a board-level topic.
70% reduction in vendor risk exposure achieved by GRCEye customers within 12 months of implementing automated TPRM, measured as the reduction in the number of vendors assessed as high or critical risk without documented remediation plans.
85% reduction in contract review time when AI contract analysis is applied. A legal team that previously spent 8–12 hours reviewing a vendor contract for security and compliance clauses completes the same review in 60–90 minutes using AI-generated analysis.
What NIS2 and DORA require from your vendor programme
Both NIS2 (Article 21) and DORA (Chapter V) impose specific supply chain security obligations on covered organizations:
NIS2 requires covered entities to assess and manage the cybersecurity risks posed by their suppliers and service providers. This includes evaluating vendor security practices as part of the entity's overall risk management programme, and taking appropriate measures to address identified supply chain risks.
DORA goes further for financial entities, requiring a comprehensive ICT third-party risk management framework that includes: a register of all ICT service providers, pre-contract due diligence, ongoing monitoring, exit strategy planning, and board-level oversight. Critical ICT third parties face direct supervisory oversight by EU authorities.
An automated TPRM platform with a complete vendor registry, documented risk assessments, and continuous monitoring provides the evidentiary foundation for demonstrating compliance with both requirements.
Getting started: a 30-day vendor risk transformation
Days 1–7: Import your vendor inventory. Start with the vendors you know about — even if the list is incomplete, starting is better than waiting for a perfect inventory. Assign initial risk tiers based on data access and operational dependency.
Days 8–14: Upload outstanding vendor contracts to the AI contract review system. The platform will identify the highest-risk contracts immediately — typically the ones with missing security obligations and liability gaps.
Days 15–21: Configure the six-dimension risk assessment for your top 20 vendors by risk tier. Run the cartography analysis. The risk concentration picture will emerge quickly.
Days 22–30: Set up automated monitoring: contract expiry alerts, questionnaire review cadences, and breach notification tracking. Configure the CISO approval workflow for new vendors.
By day 30, you have a complete, monitored vendor risk programme — not an annual questionnaire, but a living risk management system.