How to Use Threat Intelligence to Reduce Third-Party Risk

Four Ways That Threat Intelligence Helps to Mitigate Third-Party Risk

There are four primary ways that external threat intelligence can help to mitigate third-party risk.

1. Validate the effectiveness of vendor-reported internal controls

If a third-party vendor reported in their security assessment or provided evidence in a security certification (such as ISO or SOC 2) that they require a strong password, but external threat intelligence shows that vendor user IDs, passwords or admin credentials are for sale on the Dark Web, then you can reasonably surmise that the vendor’s password policies are not strong enough (or even, perhaps, that their phishing or security awareness programs need to be improved).

2. Obtain an early view into a potential vendor’s risk profile

Threat intelligence can be used to get picture of the risks that a potential vendor introduces to your environment. For example, during the sourcing and selection phase of a third-party vendor or supplier relationship, getting intelligence on prior data breaches, security incidents, compliance problems, sanctions, etc. can inform supplier selection decisions. A vendor with a low security score might not match your organization’s risk tolerance.

3. Fill gaps between regular assessment cadences

If your organization performs an annual security assessment on its third parties, external threat intelligence can fill the gaps between those annual assessments, so you are not missing out on potentially critical threats as they emerge.

4. Perform a baseline check for non-critical vendors

In most organizations, there are a subset of vendors considered critical, and your organization should complete regular comprehensive security assessments of those vendors. However, for vendors considered non-critical or lower tier, sometimes only the basics have to be performed. A profiling and tiering exercise will help you determine how to treat vendors based on whether they are critical to your company’s operations or handle sensitive customer data, for example.

Best Practices for Optimizing Third-Party Risk Intelligence

Centralize for normalization

A common approach is to look at all intel in silos, but doing so negates the benefits of gathering all that information. Instead, centralize all of these sources of threat intel in a single risk register to normalize and transform the data into meaningful results. This approach enables risk quantification and contextualization – such as mappings to various security frameworks and compliance controls – to be added to help prioritize risks and resulting remediation activities. This unified approach also enables correlation with assessment results. This will greatly streamline risk review, analysis, reporting and response initiatives.

Remediation is essential

As we learned in the 2023 Third-Party Risk Management Study, there is a significant gap between the number of companies tracking risks and remediating them. So the value of using risk intelligence in your TPRM program comes down to risk appetite and remediation. If a vendor’s threat to your organization results in a high risk score, then you have to recommend (or require) specific remediations to be implemented in order to continue doing business with them. Or, require specific compensating controls to be put in place. Regardless of the approach, a two-way dialogue is essential to risk reduction.

Next Steps for Third-Party Risk Intelligence in Your TPRM Program

Third-party risk intelligence will become increasingly important in order to keep up with changing regulatory requirements and an evolving threat landscape. For more on how advanced analytics and machine learning can be applied to identify unforeseen risks currently lurking in your supply chains, request a demo today.