Third-Party Risk Management for enterprises

Nearly half of all breaches now involve a third party — 48% in Verizon's 2026 DBIR, up from 30% a year earlier. Most enterprises have no continuous visibility into supplier security at all: they have a folder of completed questionnaires, a spreadsheet of criticality ratings, and an honest belief that both were accurate on the day they were written. A vendor's defences can collapse in a week. The question is whether you find out from a monitoring alert or from the vendor's breach notification.

Why questionnaires fail

Not because vendors lie. Because the instrument has three structural defects that no amount of diligence corrects:

1. It is self-reported. The vendor assesses itself, and the assessment is rarely verified against anything observable.
2. It is point-in-time. It records a belief held on the day the form was completed, and nothing updates it afterwards.
3. It is rarely re-read. Completed questionnaires are filed as evidence of process, not consulted as sources of risk information.

Continuous external monitoring inverts all three: independently observed, recalculated daily, and pushed to you as an alert instead of waiting to be looked up. Our guide on third-party risk management for banks and insurers works through what a tiered programme looks like in practice.

What TPRM does, job by job

Onboard a vendor without waiting for a questionnaire

Continuous monitoring covers 325 million+ companies, so most of your vendor portfolio is already rated on the day you start. A rating answers the first diligence question before a questionnaire is sent; where a contract still requires one, AI-assisted assessment pre-fills the vendor profile and analyses the answers, and the questionnaire can concentrate on the controls a rating cannot see.

Monitor continuously, and hear about movement

The signal that matters is not a vendor's absolute score but its movement — a supplier sliding forty points in a month is telling you something a static rating never will. Alerts arrive when posture changes, alongside dark and deep web intelligence across 1,000+ underground forums for credentials and data associated with your suppliers. The same question, pointed at your own estate, is what the credential exposure check works through.

Re-tier vendors on evidence

A vendor's tier should move when its risk does. Ratings give the tiering model below a measured input that changes daily, rather than a criticality score set at onboarding and never revisited.

See fourth parties

Your vendors' vendors, and the concentration risk you inherited without contracting for it.

Report the portfolio to the board

One view a board can read: how many critical vendors sit below their tier's threshold, which moved this quarter, and what was done about each. It is dated and independently calculated, which makes it evidence rather than assertion.

Tiering: the part that determines whether it works

Monitoring two hundred vendors equally produces two hundred alerts and no action. Programmes that work tier the portfolio first, set a different threshold and a different response per tier, and assign a named owner to each. Axis Max Life Insurance — whose Bitsight rating of 810 is among the highest in Indian financial services — adopted an ABCD tiered framework in which critical vendors must hold a B or better, and replaced 100% of manual vendor questionnaires with continuous monitoring.

What regulators expect

Regulators have moved decisively — the SEC and NYDFS in the US, DORA in the EU, and India's RBI, SEBI and IRDAI — toward requiring boards to evidence oversight of outsourcing and supply-chain risk rather than assert it. In India, every current instrument carries a third-party chapter — the RBI Directions of 31 July 2026 and the separate outsourcing Directions they preserve, SEBI's CSCRF, and IRDAI's 2026 Guidelines, which require third parties to be classified and overseen by risk tier. Which instrument binds you sets out the full picture.

India: the RBI outsourcing Directions, one per entity class

The RBI rewrote outsourcing as nine Directions, all dated 28 November 2025, one for each regulated class. For commercial banks they repeal the 2023 Master Direction on Outsourcing of IT Services, so a bank's vendor programme still mapped to the 2023 text is mapped to a repealed instrument. Regional Rural Banks are the only RBI class with no member of this family.

Continuous monitoring produces that evidence as a by-product of operating: a dated, independently calculated record of each critical vendor's security performance over time, a documented tiering model, and an auditable alert-and-response trail. That is a materially stronger position at examination than a folder of self-assessments.

Ratings, questionnaires or VAPT?

Each answers a different question, and a vendor programme usually needs more than one. The difference is who produces the evidence, when, and whether the vendor has to agree to it.

The longer argument is in security questionnaires vs security ratings.

Packages and vendor bands

TPRM comes in two packages, each banded by the number of vendors monitored (1–50 vendors, 51–100 vendors, 101–500 vendors, unlimited).

The practical difference is whether you need the workflow layer. Continuous Monitoring gives you visibility and alerts; adding Vendor Risk Management gives you intake, assessment, remediation tracking and governance reporting — the machinery that turns an alert into a closed action. Pricing is quoted in INR against scope; see the pricing page for what moves a quote.

Where to start

Point the instrument at yourself first. The complimentary Cyber Risk Rating Report shows you exactly what your vendors will see when you start rating them — which is both a useful calibration and, in our experience, a considerably more persuasive internal business case than a slide about supply-chain risk. If your own estate is the priority, Security Posture Management applies the same continuous measurement inward. Both run on the same Bitsight platform and the same rating.