Transforming third-party risk management: Evolving strategies for a complex cyber landscape

Transforming Third-Party Risk Management: Evolving Strategies for a Complex Cyber Landscape

Managing third-party risk is a critical challenge for organizations of all sizes, yet many cling to outdated practices, dedicating more effort to risk assessments than to proactive risk management. This paper calls for a bold re-evaluation of third-party risk management strategies. We will explore how organisations can leverage technologies and techniques such as generative AI, automation, and cyber risk quantification to assess risk more accurately and efficiently. Additionally, we will discuss how to reinvest these efficiencies into strategies that genuinely reduce risk and enhance resilience.

The third party risk challenge – you are not alone

Many of my clients are eager to learn how leading global organizations approach cybersecurity and what constitutes global better practice. Through my recent research on the strategies employed by top banks in the US and UK, along with discussions with Australian CISOs, I've found a common theme: regardless of an organisation's size or budget, managing third-party risk consistently ranks among their top three challenges. This is not surprising, given the heightened supply chain risks and increased regulatory scrutiny of how organisational resilience is impacted by third – and even fourth and fifth - parties.

Laggards and slightly lost explorers

Most Australian organisations fall into one of two categories:

For both types of organisation, it is essential to critically re-examine our approach to third-party risk management by adopting a zero-based design strategy—one that is free from the constraints of ""that's how we've always done it."" This fresh perspective will enable organizations to develop more effective and tailored risk management practices.

Charting a better way forward

In my presentation I will outline a comprehensive re-evaluation of modern third-party risk assessment. I will explore this topic through the lenses of technology, process, emerging frameworks, contractual protections, and meaningful conversations. Key points will include:

By embracing these strategies, we can truly transform our approach to third-party risk management, enabling us to evolve into more resilient and secure organisations in an increasingly complex cybersecurity landscape.