Third-Party and Vendor Risk Statistics 2026: 45 Sourced Figures

Third parties were involved in 48% of confirmed data breaches in Verizon's 2026 Data Breach Investigations Report, up from 30% a year earlier and 15% the year before that. Supply chain compromise is also one of the most expensive breach types: IBM's 2025 Cost of a Data Breach Report puts its average cost at $4.91 million and its detection and containment time at 267 days, the longest of any attack vector. Every figure below links to the report, survey or regulator that published it.

Last updated: October 5, 2026. Figures are listed with the edition year of their source.

Third-party breach statistics: how often vendors are involved

Third-party involvement in breaches has grown sharply in every recent edition of the largest breach datasets. Counting methods differ: Verizon counts any third-party involvement, including exploited vendor software, while SecurityScorecard and Black Kite count publicly reported breaches only.

1. 48% of breaches in the 2026 DBIR involved a third party, a 60% increase on the previous year (Verizon DBIR, 2026).
2. Third-party involvement in breaches doubled to 30% in the 2025 DBIR (Verizon, 2025).
3. The 2026 DBIR analyzed more than 31,000 security incidents, of which more than 22,000 were confirmed breaches, across 145 countries (Verizon DBIR, 2026).
4. Only 23% of third-party organizations fully fixed missing or poorly secured multifactor authentication on their cloud accounts (Verizon DBIR, 2026).
5. 32% of healthcare breaches involved a third party (Verizon DBIR, 2026).
6. 35.5% of the 1,000 breaches SecurityScorecard analyzed for 2024 were third-party related (SecurityScorecard, 2025).
7. 41.4% of ransomware attacks start through third parties (SecurityScorecard, 2025).
8. Retail and hospitality had the highest third-party breach rate at 52.4%; the US rate was 30.9% (SecurityScorecard, 2025).
9. 47% of organizations had a breach or cyberattack in the past 12 months that involved a third party accessing their network (Imprivata and Ponemon Institute, 2025).
10. Each third-party breach in 2025 had an average of 5.28 publicly named downstream victims (Black Kite, 2026).
11. Black Kite verified 136 third-party breach events with 719 named victim companies, and estimates about 26,000 more companies were affected but never named (Black Kite, 2026).
12. The median delay before a third-party breach was disclosed was 73 days, with an average of 117 days (Black Kite, 2026).
13. 60% of CISOs report an increase in third-party breaches over the past year (Panorays CISO Survey, 2026).

Third-party breach cost statistics

Third-party and supply chain breaches cost more and last longer than most other breach types.

14. The global average cost of a data breach reached a record $4.99 million in 2026 (IBM Cost of a Data Breach, 2026).
15. Third-party vendor and supply chain compromise cost $4.91 million on average, the second costliest attack vector (IBM Cost of a Data Breach, 2025).
16. Supply chain compromise was the second most common attack vector, at 15% of breaches (IBM, 2025).
17. Supply chain compromises took 267 days to detect and contain, the longest of any attack vector (IBM, 2025).
18. A supply chain breach added $227,244 to the average cost of a breach, the largest cost-increasing factor IBM measured (IBM, 2025).
19. Supply chain compromise, including compromised apps, APIs and plug-ins, was the most common cause of AI security incidents at 30% (IBM, 2025).
20. In Canada, supply chain compromise is the largest factor increasing breach costs, adding about CA$367,899, and the average Canadian breach costs CA$7.11 million (IBM Canada, 2026).
21. After a third-party access breach, 50% of organizations faced regulatory fines and 49% ended the relationship with the vendor (Imprivata and Ponemon Institute, 2025).
22. Nearly half of third-party risk leaders believe a major third-party incident could cost more than US$50 million (Deloitte Global TPRM Survey, 2025).

Vendor risk program statistics: how companies manage third parties

Vendor risk programs cover a fraction of the vendor base, and many still run on spreadsheets and questionnaires.

23. 65% of large companies name third-party and supply chain weaknesses as their greatest cyber challenge, up from 54% in 2025 (World Economic Forum Global Cybersecurity Outlook, 2026).
24. 66% of organizations evaluate their suppliers' security maturity, but only 33% fully map their supply chain and 27% simulate cyber incidents with suppliers (WEF, 2026).
25. 74% of highly cyber-resilient organizations assess the security of their suppliers, against 48% of insufficiently resilient ones (WEF, 2026).
26. 34% of security leaders name third-party breaches among the threats they are least prepared for, and 50% are changing vendor and supply chain risk management in response to geopolitics (PwC Global Digital Trust Insights, 2027 edition).
27. Nearly 70% of third-party risk teams are understaffed and cover only 40% of their vendor base on average (Mitratech, 2025).
28. 41% of organizations still manage third-party risk in spreadsheets, and only 29% can assess risk across the whole vendor lifecycle (Mitratech, 2025).
29. 85% of CISOs lack full visibility across their supply chain, and 71% say traditional security questionnaires fall short (Panorays CISO Survey, 2026).
30. 79% of CISOs lack a formal incident response plan for third-party breaches (Panorays, 2026).
31. 95% of business relationship owners saw a third-party red flag in the past 12 months, but only about half escalated it to compliance (Gartner, 2025).
32. Gartner predicts that by 2028, 70% of organizations and vendors will use generative AI to complete and analyze third-party security questionnaires (Gartner, 2026).
33. IT and security teams spend an average of 134 hours a week analyzing and investigating the security of third-party access (Imprivata and Ponemon Institute, 2025).

Third-party risk regulation: dates and requirements

Third-party risk management is now written into securities, banking and EU law, with fixed dates.

34. US public companies must describe whether they have processes to oversee and identify cybersecurity risks from third-party service providers, under SEC Regulation S-K Item 106 (17 CFR 229.106).
35. Material cybersecurity incidents must be disclosed on Form 8-K Item 1.05, generally within four business days of the company determining the incident is material (SEC, 2023).
36. The EU Digital Operational Resilience Act (DORA) has applied since January 17, 2025 (EIOPA).
37. On November 18, 2025, the European Supervisory Authorities designated 19 critical ICT third-party providers under DORA (ESAs list, 2025).
38. NIS2 Article 21(2)(d) requires supply chain security measures covering relationships with direct suppliers and service providers, and member states had until October 17, 2024 to transpose it (Directive (EU) 2022/2555).
39. US banking agencies issued joint Interagency Guidance on Third-Party Relationships on June 6, 2023, replacing earlier OCC third-party guidance (OCC Bulletin 2023-17).
40. Canada's OSFI Guideline B-10 on Third-Party Risk Management took effect for federally regulated financial institutions on May 1, 2024 (OSFI).
41. The New York Department of Financial Services issued guidance on managing third-party service provider risk on October 21, 2025 (NYDFS).

For SaaS companies, the same expectation shows up in audits: SOC 2 criterion CC9.2 covers vendor and business partner risk, as the SOC 2 CC9.2 vendor risk guide explains.

Third-party breach examples with official figures

The largest recent third-party incidents have official numbers from regulators and company filings.

42. The Change Healthcare breach affected about 192.7 million individuals, as reported to the HHS Office for Civil Rights in July 2025 (HHS OCR).
43. UnitedHealth Group reported $2.2 billion of direct response costs from the Change Healthcare attack in 2024, plus an estimated $867 million of business disruption (UnitedHealth Group Form 10-K, 2024).
44. The 2024 Snowflake customer campaign potentially exposed about 165 organizations, and at least 79.7% of the accounts used had prior credential exposure (Mandiant, 2024).
45. The Jaguar Land Rover cyber incident had an estimated UK financial impact of £1.9 billion and affected more than 5,000 UK organisations (Cyber Monitoring Centre, 2025).

What third-party risk statistics mean for vendors selling to enterprises

Third-party risk statistics explain why enterprise security reviews have become longer and stricter. A buyer reading that 48% of breaches involve a third party sends more questionnaires, asks for more evidence, and holds deals until the review clears.

1. Keep independent evidence current. A SOC 2 report or ISO 27001 certificate answers much of a vendor review; the SOC 2 compliance hub and the SOC 2 vs ISO 27001 comparison cover which to pursue.
2. Treat questionnaires as a repeatable process. The security questionnaire automation guide covers how to build an answer library and a standard submission package.
3. Run your own vendor reviews the same way. The third-party risk management guide and vendor risk assessment guide set out a program sized to the vendor's access.

How to cite this page

Truvo Cyber. (2026, October 5). Third-Party and Vendor Risk Statistics 2026: 45 Sourced Figures. https://truvocyber.com/blog/third-party-vendor-risk-statistics

Frequently Asked Questions

What percentage of data breaches involve a third party?

48% of breaches in Verizon's 2026 Data Breach Investigations Report involved a third party, up from 30% in the 2025 edition. SecurityScorecard, counting only publicly reported breaches, found 35.5% of 2024 breaches were third-party related.

How much does a third-party or supply chain breach cost?

Third-party vendor and supply chain compromise cost $4.91 million on average in IBM's 2025 Cost of a Data Breach Report, the second costliest attack vector. IBM's 2026 report puts the global average breach cost at $4.99 million.

How long does it take to detect a supply chain breach?

Supply chain compromises took 267 days to detect and contain in IBM's 2025 report, the longest of any attack vector. Black Kite found a median 73-day delay before third-party breaches were publicly disclosed.

Are third-party breaches increasing?

Yes. Verizon's third-party involvement figure rose from 15% to 30% to 48% across its 2024, 2025 and 2026 reports, and 60% of CISOs in Panorays' 2026 survey report an increase in third-party breaches.

Which regulations require third-party risk management?

Third-party risk requirements appear in SEC Regulation S-K Item 106, the EU's DORA and NIS2, US banking agencies' 2023 Interagency Guidance, Canada's OSFI Guideline B-10 and NYDFS guidance, among others.

Truvo Cyber answers security questionnaires and assembles the full vendor review package (report, policies, evidence and sub-processor list) for companies selling to enterprise buyers. The security questionnaire and sales enablement service page sets out what that covers.