In my newest report, Cybersecurity Threat Scores Is Remodeling Into Third-Celebration Cyber Threat Intelligence (for Forrester purchasers solely), I define a number of dynamics highlighting the constraints of cyber danger rankings (CRRs) and why change is required. CISOs are weary with CRR’s tendency to offer due-diligence information over motion, their incapability to belief the information itself, and the priority that AI will deliver extra noise and findings. This concern is evidenced by CRR platforms exhausting their progress story, experiencing a plateau in adoption.
This weblog explains why we at Forrester are making the change from cyber danger rankings to third-party cyber danger intelligence; defines third-party cyber danger intelligence; and descriptions what CISOs must do within the subsequent three years to ship worth to their third-party danger applications (TPRMs).
Cybersecurity Threat Scores Gained The Market However Misplaced The Mission
The Forrester Wave™: Cybersecurity Threat Scores Platforms, Q2 2026 and Purchaser’s Information: Cybersecurity Threat Scores Platforms, 2026 discovered that the scorecard-driven method to third-party cyber danger created by cybersecurity danger rankings resulted in trade-offs that change into exhausting to disregard and expressed the necessity for options that:
- Higher establish important course of and technical third-party safety weaknesses. CISOs want options that assist them use scarce time and sources on the problems that current the best degree of danger. With AI additional accelerating the extent of vulnerabilities being present in third-party ecosystems since frontier AI fashions reworked conventional vulnerability administration, this has taken on elevated significance.
- Considerably enhance their potential to sift out noisy findings, with restricted danger. This enables higher prioritization of findings surfaced from third-party danger assessments. Risk intelligence and adoption of recent vulnerability prioritization methods are additionally important to offer higher context and focused give attention to areas the place lively exploitations are being noticed by risk actors focusing on particular industries.
- Combine TPRM and remediation capabilities for his or her cyber applications. These capabilities mix these completely different information inputs to make sure that these important dangers get mounted. As present rankings options struggled with a lot of this, buyer adoption has plateaued, leaving restricted room for additional market growth in its present kind.
Over The Subsequent Three Years, Cyber Threat Scores Should Transfer From Findings To Threat Discount
To fulfill their aspirations above, safety and danger leaders should reject the established order of their CRR applications, make information and intelligence-driven danger discount the purpose whereas making ready for CRR platforms to fade, and embrace third-party cyber danger intelligence.
At Forrester, we outline third-party cyber danger intelligence as:
The mixing of third-party cybersecurity danger administration practices, questionnaires, and management assessments with operational context and risk intelligence to assist safety and danger groups establish exploitable, actively focused third-party dangers and prioritize remediation primarily based on operational actuality, quite than theoretical management or framework gaps.
Scores suppliers will increase present information with stronger risk intelligence and assist the total cyber TPRM lifecycle, together with corrective motion planning and remediation administration — capabilities most CRR platforms presently lack.
As this market evolves, CISOs ought to take note of the next shifts:
- Risk intelligence turns into a key differentiator in validating and prioritizing third-party danger. CISOs want to higher use risk intelligence to assist prioritize which findings or points matter most, and symbolize the best ranges of danger to a company and its third-party ecosystem. Seeing which vulnerabilities are being exploited within the wild, focusing on organizations like their suppliers, CISOs (particularly these with complicated and intensive provide chains) can focus remediation extra successfully, one thing as we speak’s options have struggled to offer. To do that, suppliers will both purchase or develop their risk intelligence capabilities over the subsequent two years to offer higher capabilities enabling CISOs to make efficient use of risk intelligence of their TPRM applications.
- Pricing mannequin transformation permits extra third-party ecosystem monitoring. CISOs discover point-in-time assessments ineffective for his or her TPRM applications, whether or not knowledgeable by a ranking or not. They should implement steady monitoring of observable information throughout their complete third-party ecosystem along with questionnaires. Extra importantly, they want a cost-effective option to broaden steady monitoring to their complete third-party ecosystem. Suppliers will reply by shifting past present consumption-based pricing fashions which have historically restricted shopper adoption of steady monitoring of suppliers. New, and extra predictable and versatile, fixed-cost pricing constructions will emerge within the subsequent 12 months, permitting organizations to broaden their protection.
- AI takes a higher position in third-party evaluation, permitting groups to give attention to danger prioritization. CISOs want their TPRM groups to find out which dangers they should prioritize inside their third-party ecosystems. At the moment’s groups spend their time aggregating data from disparate rankings and questionnaire platforms manually. AI capabilities on this market will improve considerably, permitting automation of a lot of as we speak’s evaluation burden, throughout each questionnaire returns, operational information, and era of really helpful remediation and prioritization actions. This shift will each improve the standard, and the capability of present cyber TPRM groups, permitting them to drive remediation motion with third-party stakeholders, inside the subsequent three years.
At the moment’s CRR platforms will evolve to assist built-in cyber TPRM workflows. These enhancements will shift professionals’ focus from evaluation to corrective motion administration. Safety leaders will spend much less time on evaluation and extra time driving down third-party safety dangers. Combining questionnaires and different vendor supplied due diligence with technical operational information will even create alternatives to unite historically separate safety operations middle and TPRM groups. Groups will be capable to work from a shared understanding of third-party safety dangers and change into simpler in driving focused remediation of important third-party safety points.
Forrester prospects can entry my report on this market evolution right here and might e book a steerage session or inquiry name to debate this additional with me.
