Every company outsources parts of its operations to multiple suppliers. Those suppliers, in turn, outsource their operations to other suppliers. This is fourth-party risk. The risk to your company posed by suppliers’ suppliers. Digital transformation has extended to the supply… Read More "What is Fourth-Party Risk? | UpGuard"
An attacker used artificial intelligence (AI) agents to blast through an enterprise network in less than 10 hours, significantly reducing the typical two-week time span an attack of similar magnitude would have taken. Researchers from Palo Alto Networks’ Unit 42… Read More "AI ‘Machine Speed’ Cuts 2-Week Attack Down to 10 Hours"
The following list offers three effective strategies for keeping your board informed of the business’s third-party risk exposure and the efficacy of its Third-Party Risk Management program. The board brief only holds if the TPRM program is defined across those… Read More "How to Communicate Third-Party Risk to the Board"
Cisco on Wednesday released urgent patches for a critical-severity authentication bypass vulnerability in Identity Services Engine (ISE) that has been exploited in the wild as a zero-day. Tracked as CVE-2026-76460 (CVSS score of 10/10), the security defect impacts an API… Read More "Active Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day"
ShinyHunters publicly boasted about breaching ReliaQuest, but the claims appear to be mostly hot air. In this episode of “What We Missed,” Dark Reading’s Rob Wright and Alex Culafi discuss some of the recent news events and topics that didn’t… Read More "What We Missed: Did ShinyHunters ‘Breach’ ReliaQuest?"
Vendor due diligence (VDD) is a comprehensive security screening of a potential third-party vendor before forming a partnership. The assessment identifies whether a prospect is being honest about their security posture and outlines any potential security risks that could endanger… Read More "What is Vendor Due Diligence? Choosing Secure Vendors in 2026"
Social engineers are trying to convince companies to make large-dollar transfers to their own accounts, under the guise of fake merger & acquisition (M&A) deals. It’s one of the oldest gambits in cybersecurity — the advance fee scam — for… Read More "Large Enterprises Targeted in Fake Merger & Acquisition Scams"
Vendor criticality is the level of risk that vendors are categorized into during the risk assessment phase. Determining vendor criticality is an essential part of the third-party risk management (TPRM) program to help organizations better prioritize their risk remediation goals.… Read More "How Do You Determine Vendor Criticality?"
When Maria Long heard about OpenAI’s rogue model attacking AI-model service provider Hugging Face, her first stop was to review her firm’s technology errors and omissions (tech E&O) policy. As the chief underwriting officer for cybersecurity insurance services firm Resilience,… Read More "Insurers Search for Answers to Rein in Rogue AI"
NIST 800-161 — also identified as NIST Special Publication (SP) 800-161 — was published in April 2015 as Supply Chain Risk Management Practices for Federal Information Systems and Organizations. In May 2022, a year after President Biden’s Executive Order on… Read More "What is NIST 800-161? Guide & Compliance Tips"
