Loading story…
A Panorays survey of 200 U.S. CISOs reported rising third-party security incidents alongside major visibility gaps across extended vendor ecosystems. In the findings cited by Help Net Security and SC Media, 60% of CISOs said third-party incidents increased over the past year, while only 15% said they have full visibility into third-party risk across deeper supply-chain tiers (third-, fourth-, and beyond). The reporting emphasizes that vendor dependencies now span core functions (cloud, software development, data processing, and AI services), expanding attack surface and enabling attackers to exploit less-monitored downstream relationships such as subcontractors and affiliates.
The survey also pointed to weak preparedness and governance as compounding factors: while 77% of CISOs view third-party risk as a major threat, only 21% reported having tested crisis response plans, and only 41% monitor risk beyond direct suppliers. Both articles highlight unmanaged/“shadow” AI tools as an emerging third-party risk driver, with only 22% of organizations having formal AI vetting processes and 60% of respondents identifying shadow AI as uniquely risky—creating new, poorly understood pathways for supply-chain compromise and regulatory exposure.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
On January 14, Panorays reported that 60% of CISOs had seen an increase in third-party security incidents, while only 15% said they had full visibility into third-party risks and their supply chains. The report also highlighted weak preparedness, with only a small minority reporting tested third-party breach response plans.
Panorays conducted a survey of 200 U.S. CISOs examining third-party cyber risk, supply-chain visibility, incident trends, and the impact of AI tools and AI vendors on vendor-risk management.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security leadership-focused reporting highlighted rising concern over **third-party and software supply chain risk**, with a Panorays survey of 200 US CISOs reporting that **60%** observed an increase in third-party security incidents and that more than three-quarters view third-party software risk as a major concern. The same coverage pointed to expanding dependency on external services (often **100–300 SaaS apps** per enterprise) and noted that broader **AI adoption** is increasing attack surface while also being used defensively to improve detection and response. Separate CISO-oriented content emphasized organizational and programmatic pressures rather than a discrete incident: Dark Reading described a **CISO succession/turnover problem** (average tenure cited at **18–26 months**) and linked rapid leadership churn—especially during M&A integration—to compounding security risk and burnout. Other items in the set were not incident-driven: one was a CSO Online navigation/feature listing around application security approaches (e.g., *SCA/SAST/DAST/MAST*), and another was a TechTarget roundup promoting **cybersecurity conferences** to attend in 2026; neither provided specific breach, vulnerability disclosure, or actionable threat intelligence.
Jun 29, 2026
Chief Information Security Officers (CISOs) are facing increasing complexity in managing cybersecurity risk as organizations become more reliant on managed service providers (MSPs), integrate artificial intelligence (AI) into business processes, and contend with expanding attack surfaces. Nearly half of organizations reported a cyberattack or data breach involving a third-party in the past year, highlighting the growing importance of robust vetting and governance processes for service providers. At the same time, the rapid adoption of AI has elevated cybersecurity to a top priority at the board level, with CISOs now expected to communicate risk and strategy more effectively to executive leadership. However, internal conflicts, unclear authority, and misaligned incentives between CISOs and other business leaders are often more damaging to incident response than the cyberattacks themselves, according to recent industry surveys. The threat landscape is intensifying, with a 20% year-on-year increase in high-severity vulnerabilities and attackers leveraging generative AI to exploit both new and old weaknesses. Security teams are under pressure to manage a greater volume of serious issues without corresponding increases in staff or budget, leading to operational strain. Effective vulnerability management now requires clear governance, defined scope, and continuous evaluation, while CISOs must balance technical risk reduction with business alignment and shared responsibility across the organization. As AI accelerates both attack and defense, CISOs are urged to rethink traditional risk management processes and foster stronger leadership alliances to ensure resilient cybersecurity postures.
Jun 29, 2026
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026