Loading story…
Organizations face significant challenges when evaluating software products for enterprise use, as the consequences of these decisions can be substantial for both security posture and business operations. A critical step in this process is conducting thorough risk and compliance reviews, which go beyond basic checklists to scrutinize how vendors protect organizational data, manage incidents, and fulfill contractual obligations. Security and risk professionals who excel at this stage often become trusted advisors in procurement and governance, as their diligence can prevent costly breaches and compliance failures. Effective risk and compliance reviews bridge the gap between technical performance and organizational accountability, ensuring that products which perform well in testing also meet the necessary standards for data protection and regulatory compliance. This process involves reading the fine print in vendor contracts and documentation to uncover potential risks that may not be immediately apparent during technical evaluations. By carefully analyzing vendor practices, organizations can identify weaknesses in incident response, data handling, and contractual terms that could expose them to third-party risks. The importance of this step is underscored by the fact that many security incidents originate from third-party vendors who fail to meet security expectations. Leadership and executive communication play a vital role in supporting risk and compliance reviews, as buy-in from the top ensures that these reviews are prioritized and adequately resourced. Structured tool evaluation frameworks help professionals see past the marketing of new products and focus on substantive risk factors. The process also involves cross-functional collaboration between technical teams, procurement, and legal departments to ensure all aspects of vendor risk are addressed. Organizations that invest in robust risk and compliance reviews are better positioned to avoid breaches and regulatory penalties. These reviews also support ongoing vendor management by establishing clear expectations and accountability. Ultimately, the ability to read and act on the fine print in vendor agreements can save organizations millions of dollars and protect their reputation. As the threat landscape evolves, continuous improvement of risk and compliance review processes remains essential. The lessons learned from these reviews inform future procurement strategies and strengthen overall security governance. By embedding risk and compliance considerations into every stage of the vendor lifecycle, organizations can build more resilient supply chains and reduce their exposure to third-party risks.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026
Organizations are increasingly facing cybersecurity challenges due to the interconnected nature of modern business ecosystems, particularly through third-party vendors and critical systems like Enterprise Resource Planning (ERP) platforms. As businesses expand their digital footprint, the reliance on external vendors introduces new vulnerabilities that can be exploited by cybercriminals. High-profile breaches have demonstrated that a single compromised vendor can trigger cascading effects, impacting thousands of organizations and causing widespread operational disruption. The complexity of supply chains and the integration of cloud, mobile, and IoT technologies into ERP systems further amplify these risks. ERP systems, which serve as the backbone for finance, supply chain, and other core business functions, are especially attractive targets for attackers due to the sensitive data they contain. A successful attack on an ERP system can result in significant data theft, delayed payroll, production line disruptions, and even complete operational shutdowns. Small and medium-sized businesses (SMBs) are particularly vulnerable, as they often lack the resources and in-house expertise to effectively respond to or recover from such incidents. To address these challenges, experts recommend a shift from reactive to proactive risk management, emphasizing real-time intelligence and continuous automated monitoring of third-party vendors. Building resilient security ecosystems, rather than relying on siloed approaches, is crucial for mitigating the impact of vendor-related breaches. Organizations are also encouraged to move beyond checkbox compliance and adopt data-driven, quantified risk management strategies. Applying zero-trust principles to vendor access and strengthening contractual controls can help ensure shared responsibility for security. For ERP systems, it is essential to recognize the urgency of these risks and treat any breach as a business emergency. Engaging specialized ERP developers and security professionals can help organizations implement robust preventive measures. Ultimately, protecting both third-party relationships and ERP systems is vital for maintaining business continuity and safeguarding sensitive information in an increasingly complex threat landscape. The convergence of these risks underscores the need for comprehensive, organization-wide cybersecurity strategies that address both external and internal vulnerabilities. By adopting these best practices, businesses can better defend against the evolving tactics of cyber adversaries and minimize the potential for large-scale disruptions.
Jun 29, 2026
Healthcare organizations are increasingly confronted with complex third- and fourth-party risks due to the widespread distribution of sensitive data across diverse vendor networks. Steven Adler, a partner at The Edmund Group, emphasized that data often resides not only with primary vendors but also with offshore, onshore, and even fourth-party entities, which significantly complicates compliance with HIPAA and emerging federal security regulations. The proliferation of vendors and subcontractors in the healthcare supply chain introduces new vulnerabilities, making it essential for organizations to adopt robust risk management frameworks. Adler recommends that healthcare entities maintain a patient-centric approach while ensuring that risk management strategies are closely aligned with overall business priorities. One critical step is the implementation of a vendor risk-tiering model, which ranks suppliers based on the sensitivity of the data they handle and their strategic importance to the organization. This model helps organizations prioritize oversight and allocate resources more effectively to the most critical relationships. Adler also highlights the importance of thoroughly vetting vendors, not just for their service capabilities but also for their ability to recover from disruptions. He advises that contracts with suppliers should clearly define recovery time objectives and maximum allowable downtimes to ensure business continuity in the event of an incident. Many healthcare organizations mistakenly assume that their suppliers have adequate recovery capabilities, which can lead to significant operational risks if not properly verified. The evolving regulatory landscape, including new federal mandates, further increases the pressure on healthcare providers to demonstrate due diligence in managing third-party risks. Business continuity management and disaster recovery planning are now integral components of vendor risk management programs. Organizations are encouraged to regularly evaluate the security posture of their vendors and to ensure that contractual agreements include enforceable security and recovery requirements. The growing complexity of healthcare supply chains necessitates a more proactive and structured approach to governance and risk management. By adopting these best practices, healthcare organizations can better safeguard patient data, maintain regulatory compliance, and ensure resilience against a rapidly evolving threat landscape. The insights provided by Adler at the Healthcare Security Summit in New York underscore the urgent need for stronger oversight and more sophisticated risk management strategies in the sector. As healthcare organizations continue to digitize and expand their vendor ecosystems, the ability to manage third- and fourth-party risks effectively will be a key determinant of their overall cybersecurity posture.
Jul 12, 2026