Now that vendor cyber risk changes daily, how will energy players keep pace?

The 2020 SolarWinds compromise shows how far a single trusted vendor’s exposure can reach. According to the US Government Accountability Office, attackers inserted malicious code into routine updates of the company’s Orion software, and as many as 18,000 customers received the compromised update before it was discovered. Customers that assessed SolarWinds before the compromise still faced exposure because the compromise happened after their evaluations.

The gap widens when vendors share dependencies. Traditional programs evaluate suppliers independently, while modern programs recognize that multiple critical vendors often depend on the same cloud providers, software platforms, and managed services—a form of concentration risk.

A 2024 study co-authored by KPMG found that 45% of breaches at 250 leading US energy companies were attributed to third parties, compared with 29% globally. Two-thirds of those third-party breaches involved providers of software and IT products and services, and more than a third stemmed from a single campaign: the 2023 exploitation of a vulnerability in Progress Software’s MOVEit file-transfer software. Four cases were fourth-party breaches that originated in vendors’ own MOVEit installations.

That’s the kind of shared dependency vendor-by-vendor assessments fail to reveal.

Third-party cyber risk management has to become continuous

Traditional third-party cyber risk management (TPCRM) was built on the assumptions that vendors accurately represent their security posture, and that risk changes slowly enough for annual assessments to catch meaningful concerns. Today’s threat landscape has invalidated those assumptions. Ransomware campaigns, software supply chain compromises, and rapidly evolving attack techniques can materially change a vendor’s risk profile within days or weeks. So can a vendor’s own decisions, such as the decision to undertake a major cloud migration.

TPCRM must evolve into a continuous, intelligence-driven capability that anticipates emerging threats and gives leaders the near-real-time visibility they need to make informed business decisions with confidence. The approach extends a principle already established by the US government for an organization’s own systems.

The National Institute of Standards and Technology recommends continuous monitoring to maintain visibility into assets, threats, vulnerabilities, and control effectiveness, so organizations can make timely, risk-based decisions and reduce manual effort through automation. Similarly, the Cybersecurity and Infrastructure Security Agency directs federal civilian agencies to regularly check their assets for vulnerabilities and urges private organizations to adopt similar programs.

That evolution involves shifts in how your organization manages vendor risk.

From questionnaires to continuous risk signals

Questionnaires primarily capture stated controls rather than observable reality. Self-attestation alone can create a false sense of assurance because a questionnaire reflects only what the vendor knows and chooses to report.

Consider a SaaS provider reporting during its annual assessment that all privileged accounts are protected by multifactor authentication. Six months later, a cloud migration introduces a publicly accessible administrative portal with legacy authentication enabled. No questionnaire answer would surface it, but the portal is visible to anyone monitoring the vendor’s external attack surface.

Questionnaires still have a place, but leading TPCRM programs should also incorporate objective telemetry, including

• external attack surface exposure (open ports, exposed services, shadow IT)
• known exploited vulnerabilities
• credential leaks and identity compromise indicators
• cloud and certificate misconfigurations
• security hygiene and remediation trends.

With that telemetry in place, risk becomes evidence-based and continuously observable.

From periodic reviews to continuous monitoring

Vendor environments and threat exposure can change significantly between periodic reviews. Modern TPCRM capabilities should include continuous vendor risk scoring and event-driven alerts for breaches, ransomware incidents, and critical vulnerabilities.

Reassessments should also run automatically when material changes occur. Material changes are events that significantly alter a vendor’s risk profile, such as an acquisition or merger, a major cloud migration, a credential leak affecting employees or administrators, or a significant expansion of internet-facing assets. Each event signals that previous assessment conclusions may no longer be valid.

Suppose continuous monitoring finds credentials belonging to a critical supplier’s administrators in a breach repository and, at the same time, detects new internet-facing remote access services. Together, those events automatically trigger a vendor reassessment and remediation actions.

With continuous monitoring in place, detection cycles shrink from months to near real time. Organizations can identify emerging risks before they develop into incidents, narrowing exposure windows and strengthening resilience.

From static tiering to contextual risk prioritization

Traditional vendor tiering often emphasizes spend, contract value, or generic criticality ratings—none of which captures cyber exposure. As a result, resources tend to go to large and highly visible vendors rather than to smaller, less visible suppliers whose compromise could have disproportionate operational consequences.

Contextual prioritization instead weighs factors including

• level of access (operational technology, IT, cloud, or privileged)
• operational criticality
• safety implications
• data sensitivity
• fourth-party dependencies
• concentration risk.

For instance, a company using a small contractor that services gas detection systems might classify the vendor as low risk under a spend-based methodology because the contract value is low. The vendor would receive minimal scrutiny despite maintaining its systems remotely and having privileged access to operational environments. Contextual prioritization would identify the vendor’s access as high risk because compromise could disrupt production, create safety hazards, or affect environmental compliance.

Risk management efforts then align with business impact instead of administrative classifications, concentrating resources where cyber events could have the greatest impact.

From isolated process to integrated risk function

TPCRM cannot operate in isolation. When the functions it touches work independently, critical intelligence often fails to reach decision makers. Possible results include vendors onboarded without adequate security review, delayed responses to emerging supplier threats, missed contractual controls, inconsistent risk acceptance decisions, and increased incident impacts due to lack of coordination.

Imagine procurement learns that a critical managed service provider has been acquired and plans to consolidate infrastructure into a new cloud environment. Because the information stays within procurement workflows, security teams aren’t notified and continue to rely on a previous assessment. Months later, a security incident reveals that privileged access pathways, hosting locations, and control environments had materially changed without reassessment.

That’s why effective programs integrate TPCRM across

• security operations center (SOC)
• incident response
• governance, risk, and compliance (GRC)
• enterprise risk management
• procurement
• vendor life cycle management
• legal and contracting

In this shift, third-party cyber risk becomes part of day-to-day business decision making. Vendor intelligence is shared across functions, enabling faster risk responses and more informed procurement decisions.

Across all four shifts, the fundamental change is from periodic compliance validation to continuous cyber risk intelligence. Continuing with the old model means operating with a growing visibility gap. Making the change gives you earlier visibility into emerging threats so you can act on third-party risk before it affects operations.

Proactive vendor risk management builds in stages

Threat intelligence is a key enabler of modern TPCRM, allowing organizations to move from reactive assessment to proactive risk management. The maturity model below builds on lessons learned from deploying current monitoring and threat intelligence capabilities. It shows how organizations can make the required shifts in sequence.

The first stage, augment, adds external intelligence to assessments, such as security ratings, breach disclosures, attack surface monitoring, and vulnerability intelligence. Those sources surface early signs that a vendor has been compromised or targeted and speed up reassessments. In the next stage, reprioritize, the same inputs shape vendor prioritization and resource allocation, aligning vendor risk with business impact through risk-based tiering and more focused assessments.

In the third stage, integrate, data feeds directly into SOC, GRC, and procurement workflows, where it can trigger automated escalation and an operational response. In the last stage, predict, you can use that data to analyze concentration risk and ecosystem trends, which helps you identify systemic risk and plan for strategic resilience.

As the capability matures, it should deliver results in the following areas, each with metrics you can track over time:

• faster detection—a lower mean time to identify newly exposed services, credential leaks, and attack surface changes, measured in hours or days instead of annual assessment cycles
• improved efficiency—fewer manual assessment hours per vendor, fewer full reassessments each year, and a larger share of assessment work automated through continuous monitoring and targeted reassessment
• measurable resilience—a larger share of critical vendors under continuous monitoring and fewer critical vendor visibility gaps
• stronger governance—more critical vendor risks mapped to business impact and regulatory requirements, better risk-to-control traceability, and executive reporting for high-risk third parties.

Together, those metrics reveal whether vendor oversight has shifted from periodic review to continuous assessment.

Energy’s deep vendor dependencies make third-party risk even more important

Energy organizations have good reason to build this capability. They operate in one of the most targeted and consequential cyber threat environments and face persistent pressure from ransomware groups seeking to disrupt pipelines, power generation, and distribution systems.

Increasingly, attackers are using automation and AI-enhanced reconnaissance to identify vulnerabilities and bypass traditional security controls without requiring deep operational technology (OT) expertise. The consequences of such attacks can extend beyond data loss to production, energy delivery, operational continuity, and regulatory compliance.

Several factors amplify third-party risk in the sector, including operational coupling, privileged access, and accelerated digitalization. Operational coupling means vendors are embedded within critical environments:

• Supervisory control and data acquisition (SCADA) and industrial control systems—Vendors often need remote access to diagnose, maintain, troubleshoot, and update firmware. If that access is compromised, the effects may include false system readings, process manipulation, production disruptions, equipment damage, or interference with safety functions.
• Energy management platforms—Software providers and equipment manufacturers often support systems that balance loads, monitor grid conditions, and coordinate energy distribution. Platform compromise can affect operational decision making across broad portions of the business.
• Digital oilfield operations—Vendors increasingly support remote monitoring, IoT sensors, analytics platforms, and digital twins. In many cases, those products and services not only collect field data but also influence operational decisions that affect production and maintenance.

The next factor, privileged access, refers to the long-lived remote connections and elevated privileges vendors gain across IT and OT environments. Vendors need this access because operational support requires rapid response. While operationally convenient, long-lived credentials increase risk exposure. If those trusted connections are compromised through stolen credentials, exposed maintenance interfaces, or weak access controls, attackers could gain direct access to operational environments. That’s why current, continuous assessment matters most for vendors with that kind of access.

Another factor, accelerated digitalization, refers to how every additional cloud service, connected device, remote monitoring platform, and data integration creates yet another vendor dependency and expands the attack surface.

A first-year roadmap to continuous third-party risk visibility

Those same factors indicate where to start: with the vendors whose access and operational roles carry the most risk.

You can accelerate this transformation in your organization through a focused set of actions. The roadmap that follows, based on experience establishing new TPCRM programs, sequences those actions into phases of roughly 90 days each. By the end of the first year, the program should deliver measurable business outcomes, reduce risk exposure, and give you capabilities that scale.

Phase 1 (days 0–90): Identify and prioritize critical vendors

The first phase determines which third parties create the greatest operational, cybersecurity, safety, and business risk. It starts with a cross-functional workshop involving cybersecurity, procurement, vendor management, operations, OT, and key business stakeholders. From there:

• export existing vendor data from procurement, contract management, and third-party risk management (TPRM) systems
• classify vendors by access to corporate or OT environments, access to sensitive data, operational criticality, and role in safety, production, or regulatory compliance
• create risk tiers and identify the subset requiring continuous oversight.

By day 90, every active vendor is accounted for. Stakeholders have confirmed which vendors are critical. And leadership can produce a risk-ranked inventory of vendors that could cause the greatest business, operational, or cyber impact if compromised.

Phase 2 (days 90–180): Deploy continuous monitoring

The second phase moves you from point-in-time assessments to ongoing visibility. To do that:

• select a continuous monitoring provider or capability
• integrate vendor records from the TPRM platform or vendor inventory
• configure the system to track external attack surface exposure, vulnerability disclosures, breach notifications, credential leaks, security rating changes, and, where applicable, dark web indicators
• define alert thresholds and escalation criteria.

By day 180, all critical vendors are continuously monitored. Risk alerts flow into governance workflows, and you receive actionable vendor risk intelligence without waiting for annual assessments.

Phase 3 (days 180–270): Integrate vendor intelligence into security operations

The third phase ensures that vendor risk intelligence drives operational response. To make that happen:

• define which vendor events are material enough to require investigation
• feed monitoring data into the SOC’s security information and event management (SIEM) or case-management platform
• establish response playbooks for vendor-related incidents
• assign ownership for alert triage and escalation.

By day 270, vendor alerts automatically create investigations or tickets, and SOC analysts routinely review vendor-related intelligence. At this point, a significant vendor event triggers the same disciplined response process used for internal cyber threats.

Phase 4 (days 270–365): Embed oversight across the vendor life cycle

The final stretch makes TPCRM a continuous business process. In this phase:

• integrate risk requirements into onboarding, contracting, renewal, change-management, and offboarding processes
• establish reassessment triggers for material changes, such as ownership transfers, cloud migrations, significant scope expansions, security incidents, and new privileged access
• define governance metrics and executive reporting.

By day 365, you have a TPCRM policy and procedures that cover the full vendor life cycle. Renewal and onboarding decisions incorporate current vendor risk intelligence. Material changes automatically trigger reassessments. And vendor oversight is embedded in operational processes rather than performed once a year.

Vendor risk is now a resilience question for energy leaders

The key question now is whether you can detect and respond to changes in vendor risk. Historically, TPCRM has been treated as a control function focused on vendor approval and compliance. Increasingly, it’s becoming a business resilience capability.

Without continuous visibility, business decisions rest on outdated assumptions about vendor risk, leading your organization to expand partnerships, grant privileged access, or depend on suppliers whose security posture has materially changed since the last assessment. With continuous visibility, you can identify emerging risks early and make better-informed decisions about everything from suppliers to digital transformation initiatives. Ultimately, the competitive advantage will belong not to the organizations that assess vendors most often, but to those that can respond to change the fastest.