As Evolving Risks Rise in a Rapidly Digital World, Companies are Utilizing TPRM and AI

Modern enterprises don’t work by themselves anymore. Enterprises now leverage an intricate web of vendor ecosystems with systems talking to one another using APIs, connectors, and shared data sets. In fact, modern enterprises see third parties as an essential ingredient of innovation and growth, even in industries with heavy regulation such as finance and healthcare.  

While this interconnectedness presents new and important opportunities, it also presents a tremendous amount of risk. Industry reports are stating that 60% of all data breaches come from an enterprise’s supply chain, which means that third-party risk is a top of mind concern in all sectors. As modern businesses expand their vendor networks and lean more heavily on cloud-type infrastructures, the risk they are at for breaches or attacks increases exponentially. 

For an enterprise, the larger and more complicated it gets, the more difficult it is to manage governance, risk, and compliance (GRC). For innovative leaders, TPRM isn’t a nice to have, it’s an essential feature of growth, innovation, and resilience.

Third-Party Risk Management: Why It Is More Important Now Than Ever

TPRM, at its core, involves evaluating and monitoring the behavior, performance, and risk that each vendor represents. As an example, TPRM extends beyond cybersecurity to include:

– Data Privacy and Security Standards– We want our vendors to comply with our corporate privacy standards.  

– Corporate and Social Responsibility (CSR) – We want to ensure vendors comply with our sustainability, ethics, and labor standards.

– Anti-Bribery and Anti-Corruption (ABAC) – We want to ensure vendors are neither reputational nor legal risk.

– Compliance (Industry-specific) – We want vendors to comply with our healthcare, financial, or industry-specific regulatory requirements.

The urgency and need for TPRM was emphasized when the US Office of the Comptroller of the Currency mandated that all regulated banks manage and mitigate risk across the third-party relationships. Since then, organizations have cascaded vendor oversight into nearly every industry , especially with the continuing growth in the sophistication and frequency of ransomware and cyber-attacks.  

Healthcare organizations, for example, are now the target of choice for attackers looking to steal patient health data or breach hospital operating systems. Entities in the manufacturing sector have also faced increasing ransomware attempts where, due to their need for real-time actions, a single minute of downtime can cost millions of dollars in loss of revenue. 

Industry 4.0: Opportunities and Threats for Manufacturing

While industries like finance and retail have moved full speed ahead with digital transformation, the industrial and manufacturing industries have lagged behind from a technology and population perspective.  Today, a typical factory may adopt connected factories, robotics, IoT-based devices, and data-driven automation as standard operating procedure, as opposed to an innovation.

But along with this innovation comes a larger attack surface . One weak spot in a vendor’s network can expose an entire factory network making it vulnerable to ransomware or dire attacks. The IBM Security 2023 X-Force Threat Intelligence Index shows that the manufacturing sector was the most hacked industry in terms of ransomware attacks for a second year in a row in 2022. The study showed that lower tolerance for downtime in manufacturing companies made them especially vulnerable by extortion.

The Boston Consulting Group (BCG), surveyed over 600 managers in the US and Germany on their views of Industry 4.0 adoption. What we learned:

• 41 % of German manufacturers identified data security needs first. 32% of US Manufacturers identified data security needs first, but often much less than their German Manufacturer peers.
• Both counties indicated significant investment costs associated with Industry 4.0 adoption, especially in secure adoption.

The research highlights the urgent need for integrated risk management solutions in manufacturing, where only one vendor risk is dependent on operational resilience.

Risk is a Team Sport, not a stand-alone activity: Integration of IT and OT

Traditionally, risk management roles and responsibilities have been considered separate departments:

• IT Teams focused on cybersecurity, compliance, and data protection. 
• OT Teams focused on operational resilience, uptime, and physical system security.