New research by Drata shows that while organizations have addressed third-party risk management (TPRM) by buying new tools and automating more of the work, these investments have had little impact on the issue and associated risks.
In a survey of 309 IT and security leaders and practitioners across the US, UK, and Canada, 78% told Drata that insufficient people or tool capabilities still limit how many third parties they can assess and how thoroughly they can assess them. The most-cited obstacle is staffing, but only 11% list adding headcount as a top priority for the year ahead.
Three gaps show up clearly in the data, and they compound one another.
The first is coverage. Only 13% of organizations assess all their third parties. Every vendor that goes unassessed can still introduce operational risk into the environment, so the 87% who cover less than everything are carrying unmeasured exposure by default.
The second is depth. Among the vendors that do get assessed, 93% receive a less-than-thorough review. For most programmes, that means little more than confirming a partner holds a SOC 2 report, rather than evaluating the vendor against defined risk criteria.
The third is freshness. Most programmes reassess critical vendors once a year at most, which describes 76% of respondents. A lot changes in 12 months. A single vendor turning on an agentic workflow can shift its security posture in an afternoon, long before the next annual review comes due.
Underneath all three sits a human problem. A full assessment of a critical vendor typically takes three to four weeks, and Drata’s data puts each one at roughly 16 hours of an analyst’s hands-on time. At that rate, one analyst can complete fewer than 100 thorough assessments a year. An enterprise with a few hundred critical vendors needs several full-time analysts just to keep pace, and most enterprises work with thousands of vendors. The arithmetic explains why coverage, depth, and cadence are all issues.
Incidents are common
In the past 12 months, 85% of organizations reported at least one third-party-related security incident and roughly two-thirds reported two or more.
The organizations getting hit hardest are the ones most likely to name capacity as the problem. Among those that experienced six or more incidents, 90% agreed that people or tool limits are constraining their assessments, compared with 60% of those that had no incidents at all. The more real-world risk a programme faces, the less its current approach can keep up.
AI is the new blind spot
AI is now embedded in the products and services vendors sell, and most programmes have no consistent way to evaluate it.
A majority of respondents, 58%, have no standardised process for assessing third-party AI risk. Only 37% are highly confident they can even identify where AI is being used inside a vendor’s products and services.
AI-specific governance ranks among the weakest rated capabilities, although this ranked as the second-highest improvement priority for the coming year, nearly tied with automating data collection.
Drivers for TPRM
The survey found that key drivers are operational resilience (69%) and regulatory requirements (53%), with regimes like DORA, NIS2, and the SEC cyber-disclosure rule raising the bar on third-party oversight.
