A good model for predicting third-party risk is only as good as the data you feed it. To help organizations choose the best data to power their third-party risk models, RiskRecon partnered with Cyentia Institute to conduct a research study that quantifies how high-fidelity data turns risk assessments from an exercise of uncertainty to one of understanding. From Uncertainty to Understanding.
This new “From Uncertainty to Understanding" research report examines the value of data that drives security assessments and presents four models for evaluating vendor risk posture based on a sample of nearly 40,000 firms from RiskRecon's massive dataset.
The research aims to address the following two questions:
- What information is most valuable and trustworthy to measure third-party risk?
- Is there a better way to get the information you need to measure third-party risk at scale?
Using empirical research methods, RiskRecon and Cyentia Institute were able to identify the highest-value data categories and compare the power of different models in how they measure which vendors represent the greatest risk to sourcing organizations.
Key takeaways:
- Industry-specific models only explain 2.8% of a firm’s risk posture.
- Vendor risk assessments based on the full range of technical data collected by RiskRecon provide 22X greater power for predicting risk posture than other models tested
- Smaller businesses (10-100 hosts) are more likely to have important findings on their most critical assets compared to larger peers (1,000-10,000 hosts).
- The software industry is more likely to be better at managing its critical assets than firms with similar technical profiles (number of hosts, geolocations, etc.) in the manufacturing industry.
Third-party risk practitioners recognize that security assessments are difficult. The process of onboarding and verifying the cybersecurity posture of another organization is typically a manual process that does not yield in-depth answers that truly measure how secure a firm's environment is.
Third-party risk management (TPRM) typically requires triaging a large number of vendors and making critical supply chain risk decisions based on imperfect information. A recent research report from RiskRecon and Cyentia Institute found that 85% of security professionals don't believe the responses they receive from vendor questionnaires.
This study shows that using a full range of technical insight provided by the RiskRecon platform offers 22X greater power for predicting risk posture than traditional assessment models.
The “From Uncertainty to Understanding" report does not advocate for the removal of security questionnaires, rather it is intended to help firms save time on TPRM by strategically considering the data that is most valuable to their TPRM program.
To learn about ways RiskRecon can support your third-party and enterprise risk needs, read more here.
You can find more insights on the research we gathered with Cyentia Institute here.
