Proof Over Promises: A New Doctrine Strengthens Cybersecurity Amid Rising Third-Party Breaches

In recent years, the cybersecurity landscape has undergone significant changes, particularly regarding third-party relationships between vendors and their customers. A report indicated that 51% of organizations in the UK experienced breaches linked to third-party vendors within the last year. This alarming statistic highlights the growing vulnerabilities associated with vendor relationships, as these entities have increasingly become prime targets for cybercriminals.

Transitioning from Trust to Evidence

Historically, trust-based compliance was the standard for cybersecurity vendors. However, this approach is becoming obsolete. The traditional reliance on contracts and verbal assurances is no longer sufficient to protect organizations from the evolving threat landscape. Cyberattacks are not only becoming more frequent but also more damaging, often employing relatively simple techniques that can bypass outdated security measures.

The shift in focus from mere compliance to evidence-based security is crucial. Organizations can no longer afford to operate under the assumption that vendors are secure based solely on past certifications or contractual agreements. Instead, a proactive approach that emphasizes demonstrable security measures is essential.

The Challenge of Structural Blindness

Many vendors do not intentionally obscure vulnerabilities from their customers. However, issues related to latency and visibility can create a form of structural blindness. Point-in-time assessments quickly become outdated as systems evolve and new technologies are deployed. A vendor deemed secure at the time of certification may pose significant risks shortly thereafter if they lack a consistent vulnerability management strategy.

This lack of visibility is compounded by the tendency of some vendors to adopt a willfully ignorant stance, prioritizing cost savings over comprehensive security measures. As a result, customers are often left unaware of the actual risks they face.

Continuous Penetration Testing as a Solution

To combat these challenges, continuous penetration testing has emerged as a vital practice for vendors. Infrequent or ad hoc testing leaves security teams struggling to keep pace with the rapidly changing threat landscape. By simulating real-world attack scenarios, vendors can not only demonstrate their commitment to robust security frameworks but also enhance their vulnerability management processes.

This proactive approach reduces the risk of data breaches and provides customers with tangible evidence of security measures in place. For organizations managing multiple third-party relationships, such visibility is critical for understanding where real risks lie and for fostering stronger customer relationships.

The Role of CISOs in Elevating Security Standards

As supply chains become increasingly targeted by cybercriminals, the role of Chief Information Security Officers (CISOs) is more important than ever. High-profile incidents, such as the Jaguar Land Rover attack in September 2025, have underscored the potential for widespread disruption stemming from third-party breaches. In this context, CISOs are uniquely positioned to advocate for higher security standards among vendors.

By demanding that third-party security teams provide demonstrable proof of their security measures, CISOs can help bridge the gap between vendor and customer expectations. This shift towards evidence-based security is not about penalizing vendors but rather fostering a collaborative environment where both parties can work together to enhance resilience.

Moving Beyond Static Assurances

The cybersecurity landscape is in a constant state of flux, and static assurances are no longer adequate indicators of a mature security posture. Organizations must embrace continuous testing and monitoring to keep pace with evolving risks. By prioritizing evidence over promises, businesses can shift away from blind trust and towards a framework grounded in measurable security practices.

This transition is essential for managing third-party risk effectively. As organizations adapt to the realities of modern cybersecurity, the emphasis must be on ongoing assurance rather than outdated contractual obligations.

For further insights into effective cybersecurity measures, visit www.techradar.com.