Third-Party Security Debt

Third-Party Security Debt

All developers are familiar with technical debt. The shortcut taken knowingly; a quick fix, a simplified architecture, a test postponed for later. Technical debt is not a mistake. It is a trade-off. The problem is never incurring it; it is forgetting about it. Because it does not disappear. It sleeps, it accumulates, and it eventually comes back to haunt you, often at the worst time, and always all at once.

There is an equivalent in risk management that is talked about much less. I call it third-party security debt.

Every time an organization onboard a new vendor without properly assessing them, it incurs a line of debt. Access granted without verification. A contract signed without a cyber annex. A subcontractor who brings in three others, whose names no one knows. Taken in isolation, each of these shortcuts is invisible. Put end-to-end, over several years and several hundred suppliers, they form a massive and unmeasured exposure. Without an expert and well-defined methodology, each new supplier is not just a business relationship. It is a potential ticking time bomb.

Why the Debt Accumulates: The Orphan Risk

If this debt grows so quietly, it is for a structural reason: supplier risk most often has no owner.

Look at how it is handled in most organizations. It is too technical for Procurement, which negotiates a contract without being able to judge a security posture. It is too contractual and too late for Security, which discovers the vendor once the signature is secured. It is too diffuse for the Business department, which depends on the supplier daily without feeling responsible for its cyber risk. Everyone sees one side of it. No one holds the whole picture.

This is a topic whose frequency is increasing and whose complexity is constantly growing — new services, new SaaS dependencies, new regulatory obligations. And it is precisely this highly specialized subject that receives the fewest dedicated resources. The result is an anomaly that has come to be viewed as normal: non-specialist teams, already stretched thin, managing one of the company's most technical risks in their spare time.

In a large group, a dedicated TPRM team absorbs this paradox. But the majority of companies are not large groups. In an SME or mid-market company, there is no TPRM team. There is one person, in Security or Procurement, who inherits the file on top of everything else. Supplier risk then falls into an organizational blind spot. No one decided to ignore it. No one borrows willingly. The debt is inherited due to a lack of structure.

The Bill Is Due

For about fifteen years, this way of doing things held up. We delegated, we hoped, we checked the contractual box. And that was enough, as long as supplier risk remained largely theoretical.

It no longer is. The 2025 Verizon Data Breach Investigations Report, which analyzes over 22,000 security incidents, delivers an unambiguous figure: the share of breaches involving a third party has doubled in one year, from 15% to 30%. One in three breaches now transits through a vendor, a supplier, a partner.

This doubling, within twelve months, is not a statistical accident. It is the market collectively receiving the bill for a decade of under-prioritization. Third-party security debt is no longer sleeping. It is being called in. And the operational reality is simple: supplier risk can no longer be bypassed.

What Will Not Fix the Problem

Faced with this realization, the initial reactions are understandable but mostly ineffective.

Hire a dedicated team? Very few organizations have the budget for it, and the market for TPRM specialists is narrow. Assess all of your suppliers? This is arithmetically unsustainable, operationally unrealistic, and above all, undesirable: the vast majority of a vendor landscape does not justify a deep assessment. Pile on security questionnaires? This just shifts the burden onto the vendor and the teams reviewing the answers, without ever reducing the actual risk.

The common thread among these false solutions is that they all think in terms of volume of resources. Yet the problem is not a resource problem. It is a methodological problem.

The way out consists of making the debt manageable with constant resources: identifying the truly critical fraction of the supplier base, which is generally much smaller than believed, concentrating the assessment effort there, and corporate-scaling the processing of everything else. This is precisely the logic that we have condensed into a short and operational prioritization guide: sorting before assessing, to stop being overwhelmed by volume.

Stop Borrowing

You never pay off third-party security debt all at once, and that is not the goal. The goal is twofold: stop operating blindly and incurring debt, and pay off the highest-risk lines first.

This does not require a budget you do not have. It requires a simple, clear, and defensible methodology: knowing how to identify your critical risks and handling them in a fraction of the time currently taken by a typical audit, without skyrocketing costs or exhausting teams who were never meant to carry this weight alone.

This is precisely what we will be discussing on June 10th at 11:30 AM, during a session co-hosted with our partner Aprovall: how to divide vendor cyber audit times by ten, without overburdening the teams. If this topic speaks to you, and if you recognized your own organization while reading this column, you are very welcome to join.

Étienne