[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:third-party-risk-management":3},{"control":4,"products":25,"stories":58,"lessons":102,"related":127,"compare":132},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.","An inventory of suppliers ranked by how critical they are, security assessments before and during the contract, and monitoring for supplier incidents.","Supplier breaches have caused some of the largest incidents of recent years, through software updates, payroll services and file transfer tools. NIS2 and DORA both make supply chain security an explicit duty, and DORA requires a register of ICT providers. Knowing your critical suppliers and watching them turns a surprise into a planned response.",[11,12,13,14],"Does it rank suppliers by criticality and data access, instead of sending everyone the same questionnaire?","Does it monitor suppliers continuously for breaches and exposures?","Can it produce the DORA register of information?","How are our suppliers' own suppliers handled?","Risk: a breach at a critical supplier exposes our data or stops operations. Control: supplier inventory with criticality tiers, assessments and continuous monitoring. Owner: procurement together with the CISO. Measure: critical suppliers with a current assessment.",[17,18,19,20],"NIS2 Art. 21(2)(d) and 21(3): supply chain security","DORA Art. 28 to 30: ICT third-party risk and the register of information","CIS Control 15: service provider management","ISO\u002FIEC 27001:2022 A.5.19 to A.5.22: supplier relationships",{"name":22,"slug":23},"Supply Chain","supply-chain","2026-10-16T12:48:26.722314+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"total":59,"last_days":60,"recent":61},324,82,[62,67,72,77,82,87,92,97],{"slug":63,"title":64,"published_at":65,"brief":66},"hackers-use-compromised-connectwise-credential-to-sign-in-to-173-microsoft-365-t-614eb3","Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants","2026-10-17T06:16:46+00:00","Hackers use a stolen ConnectWise credential to access 173 Microsoft 365 tenants.",{"slug":68,"title":69,"published_at":70,"brief":71},"ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack-0077d1","Ledger asks sellers across Asia to halt sales after supply-chain attack","2026-10-14T17:46:50+00:00","Ledger halts sales in Asia after discovering tampered crypto wallets with spy chips.",{"slug":73,"title":74,"published_at":75,"brief":76},"86-million-crypto-heist-linked-to-ledger-signer-hardware-implant-6377b2","$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant","2026-10-13T10:36:05+00:00","Hardware implant in Ledger signers linked to $86M crypto heist.",{"slug":78,"title":79,"published_at":80,"brief":81},"ledger-finds-unauthorized-hardware-implant-in-cryptobilis-sold-wallet-amid-fund--001d5c","Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports","2026-10-12T11:21:48+00:00","Ledger pauses sales via CryptoBilis after reports of $86M fund theft linked to tampered hardware wallets.",{"slug":83,"title":84,"published_at":85,"brief":86},"irhythm-data-breach-impacts-at-least-360-000-people-7efaee","iRhythm Data Breach Impacts at Least 360,000 People","2026-10-12T11:05:43+00:00","iRhythm data breach exposes personal information of over 360,000 patients.",{"slug":88,"title":89,"published_at":90,"brief":91},"ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe-c54aeb","Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe","2026-10-12T10:32:05+00:00","Ransomware response expert Edward Dubrovsky arrested in US for alleged involvement in ShinyHunters attacks.",{"slug":93,"title":94,"published_at":95,"brief":96},"canadian-cybersecurity-executive-arrested-in-federal-extortion-case-a2f18c","Canadian cybersecurity executive arrested in federal extortion case","2026-10-10T13:35:50+00:00","Cybersecurity executive arrested for extortion conspiracy linked to ShinyHunters FBI breach.",{"slug":98,"title":99,"published_at":100,"brief":101},"fbi-arrests-another-shinyhunters-suspect-reportedly-involved-in-its-jobs-portal--30dc1b","FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack","2026-10-09T17:45:26+00:00","FBI arrests a Canadian citizen in Pennsylvania linked to the ShinyHunters data breach.",[103,107,111,115,119,123],{"slug":104,"title":105,"published_at":106},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":108,"title":109,"published_at":110},"hardware-implants-in-crypto-wallets-expose-supply-chain-risks","Hardware Implants in Crypto Wallets Expose Supply-Chain Risks","2026-10-14T18:20:46.881+00:00",{"slug":112,"title":113,"published_at":114},"hardware-implant-in-reseller-crypto-wallets-drains-86m","Hardware Implant in Reseller Crypto Wallets Drains $86M","2026-10-13T12:21:47.245+00:00",{"slug":116,"title":117,"published_at":118},"unpatched-contractor-software-opens-fbi-systems-to-shinyhunters-breach","Unpatched Contractor Software Opens FBI Systems to ShinyHunters Breach","2026-10-12T12:22:22.353+00:00",{"slug":120,"title":121,"published_at":122},"irhythm-breach-third-party-app-risk-exposes-360000-patients","iRhythm Breach: Third-Party App Risk Exposes 360,000 Patients","2026-10-12T12:21:39.014+00:00",{"slug":124,"title":125,"published_at":126},"cybersecurity-executive-arrested-for-alleged-extortion-tied-to-shinyhunters-breach","Cybersecurity Executive Arrested for Alleged Extortion Tied to ShinyHunters Breach","2026-10-10T14:20:17.236+00:00",[128],{"slug":129,"name":130,"problem":131},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"bitsight\u002Fbitsight-tprm":133,"onetrust\u002Fthird-party-management":145,"securityscorecard\u002Fsecurity-ratings":154,"upguard\u002Fupguard-vendor-risk":163},{"hq_country":134,"also_provides":135,"reviews":136,"affected":143,"reported":144},"US",[],[137,140],{"label":138,"url":139},"PeerSpot: Bitsight user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fbitsight-reviews",{"label":141,"url":142},"Gartner Peer Insights: Bitsight Cyber Risk Intellligence user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fbitsight-cyber-risk-intelligence",0,4,{"hq_country":134,"also_provides":146,"reviews":147,"affected":143,"reported":143},[],[148,151],{"label":149,"url":150},"PeerSpot: OneTrust GRC user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fonetrust-grc-reviews",{"label":152,"url":153},"Gartner Peer Insights: OneTrust Third-Party Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fonetrust-third-party-management",{"hq_country":134,"also_provides":155,"reviews":156,"affected":143,"reported":143},[],[157,160],{"label":158,"url":159},"PeerSpot: SecurityScorecard user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsecurityscorecard-reviews",{"label":161,"url":162},"Gartner Peer Insights: SecurityScorecard TITAN AI user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ftitan-ai",{"hq_country":164,"also_provides":165,"reviews":166,"affected":143,"reported":170},null,[],[167],{"label":168,"url":169},"Gartner Peer Insights: UpGuard Vendor Risk user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fupguard-cyberrisk",1]