Supply chain risks have skyrocketed recently, and the situation could be even more serious than we realise. As supply chains grow more complex, visibility is falling instead of rising. A new report from Panorays, experts in third-party risk management, reveals that only 15% of CISOs can claim to have full visibility into all their third, fourth, and Nth-party relationships.
The new CISO Survey for Third-Party Cyber Risk Management is based on responses from 200 full-time CISOs at mid to large companies in the US, spread across industries. It reveals growing pressure on CISOs and their teams to keep on top of supply chain risk, the gaps in their practices, and how they are acting to fill those gaps.
The report paints a picture of gaps in supply chain risk management and how new strategies and technologies are emerging to close them. According to the report, most popular supply chain risk tools are of limited impact, as two-thirds of the CISOs surveyed said that traditional GRC platforms are only somewhat or not at all effective in managing third-party cyber risk.
The overall theme is concerning. Cyber risk visibility is limited, resources are still constrained, and tools don’t live up to their promise. But on the positive side, it shows that CISOs are aware of the dangers they face, and are developing new responses.
The cyber supply chain is the eye of the storm
As the report emphasises, third-party cyber risk is among CISOs’ biggest nightmares. Over three-quarters rank it as one of their top threats, with 23% placing it at the pinnacle of their risk fears. Third-party cyber incidents rose over the past year, according to 60% of participating CISOs.
This will come as no surprise to anyone who has watched external attack surfaces multiply in the past year, as data processors, cloud infrastructure, AI integrations, and software providers all grew in number. Security leaders have warned for some time that the rush to the cloud created a slew of potential weak links in the security chain.
It’s arguable that the complex, unsecured supply chain is the fundamental cybersecurity threat in 2026, with AI simply coming to tap on an existing weak spot. In this sense, the CISO Survey for Third-Party Cyber Risk Management resonates with recent warnings from Mark Atwood, managing VP of research at Gartner, that CISOs need to prioritise supply chain security for 2026.
Visibility is dimming just when it needs to be clear
Supply chain visibility is falling significantly, highlighting the extent to which expansion has outpaced CISO ability to keep track.
Most security programmes focus on direct vendors only, even though they were responsible for just half of all cybersecurity incidents. One out of every two reported supply chain breaches was caused by fourth parties, nth parties, or other external entities like partners and contractors.
Only 15% report having full visibility into the entirety of their supply chain, with 41% agreeing that they monitor fourth parties for cyber risks and just 13% tracking Nth-party vendors. Unfortunately, attackers know that the further a vendor is down the supply chain, the less likely they are to be subjected to robust monitoring or assessment, so they’re exploiting this weakness.
Many other reports over the past year have warned about attack surface invisibility. The World Economic Forum’s Global Cybersecurity Outlook 2025 noted that supply chain interdependencies are the biggest obstacle to cyber resilience for 54% of large organisations, constituting the top cyber risk for global ecosystems.
Traditional cyber risk tools are not working
The fact that supply chain incidents are still increasing year-on-year casts a serious shadow on the efficacy of existing risk management strategies and solutions. The Panorays report found that GRC adoption stands at 61%, but only 34% of users agree that the tools are very effective at tracking risk exposure, whereas 22% say they are not effective at all.
This backs up opinions that have been shared by thought leaders. Trend Micro’s Juan Pablo Castro is just one security expert who cautioned organisations against trying to manage multi-faceted, complex, fast-moving risk with tools that were created for slower, more stable risks, and have not been overhauled to match the new risk landscape.
The sad reality is that GRC platforms were not designed for continuous, Nth-party oversight. Manual workflows slow teams down, allow vulnerabilities to go undetected, introduce inconsistencies, and can’t support continuous monitoring. Unable to reflect evolving threats, they leave teams with a false sense of security.
According to the report, 71% of CISOs think that vendor questionnaires fail to capture real third-party risk, instead wasting time that could be better spent on other risk-mitigation tasks.
New supply chain risk management strategies are emerging
To end on a positive note, the report does bring hope that security teams are changing their risk management activities to successfully frustrate supply chain attacks. Adoption for AI-driven risk assessments is rising, with 66% saying that they’ve already implemented these solutions and only 1% saying that they don’t intend to introduce them.
With AI-driven workflows, security teams will have more time to validate and mitigate genuine risks, instead of getting bogged down in the repetitive busy-work of manual questionnaires.
AI-powered third-party risk management (TPRM) solutions reduce fatigue, improve consistency, and enhance accuracy around risk prediction.
Supply chain risks are considerable, but there are solutions
The Panorays report paints a clear and concerning picture about the threats of supply chain incidents, and doesn’t skip over the gaps in supply chain security. However, it’s also evident that CISOs are working hard to find the best ways of closing gaps and adapting strategies to fit the new reality.
Image source: Unsplash
