Third-Party Risk Is Moving Faster Than Annual Questionnaires Can Track

When a critical PHP vulnerability emerged last week, Richard Stiennon moved quickly to check every web property he manages. The host of the Security Strategist Podcast had been fortunate as he had recently moved away from WordPress, while the one site he still manages for someone else had automatic PHP updates enabled. But the incident highlighted a much bigger challenge for organisations responsible for thousands of third-party relationships.

Now imagine having to assess that level of exposure across 10,000 suppliers. For Sean Cronin, CEO of ProcessUnity, this is the reality facing third-party risk teams. Annual questionnaires and periodic assessments cannot keep pace with vulnerabilities that emerge, supplier relationships that change and risks that extend deep into supply chains. As Cronin suggests, organisations need to start thinking about third-party risk as a live signal rather than a periodic exercise.

In this episode, Stiennon speaks with Cronin, a risk management veteran of more than 25 years, about how continuous monitoring, automation and AI are changing supplier risk assessment. They discuss how to verify actual exposure, uncover fourth- and fifth-party dependencies, cut through alert noise, and pair automated intelligence with human judgement.

Third-Party Risk Management Has Outgrown Paperwork

Cronin has spent more than 25 years in risk management, in the field since before “governance, risk and compliance” was a recognised term. He remembers when banks and other heavily regulated firms employed hundreds of assessors who travelled to suppliers, inspected premises and worked through stacks of paperwork. Spreadsheets and software followed, but the underlying problem has only grown.

“The ecosystems that our clients are powered by and working with and depend upon are growing at a rate faster than the employees that can staff up and assess them,” he says. The task has changed, in his words, “from a paperwork problem to a resilience challenge and opportunity”.

AI Cyber Threats Are Speeding Up Vulnerabilities

Part of the pressure comes from the other side. Cronin says criminals’ adoption of AI has changed how critical vulnerabilities are. Teams once reacted to the occasional major flaw by working out who was affected. Now new ones arrive daily, sometimes several times a day.

Speed is the answer. If a company can quickly establish that 10 of its 15,000 vendors are exposed, it can ask those ten whether they have mitigated the problem and set the rest aside. Cronin says the old just-in-time approach no longer works. “We have to be dealing in real time.”

Vendor Vulnerabilities Hit 58% of Ecosystems

Cronin says 58 per cent of the vendor ecosystem across ProcessUnity’s client base was affected by vulnerabilities in two weeks, and the figure rose once the PHP flaw was added. He admits he did not believe it at first. Being affected is not the same as being compromised, but the burden of proof still falls on the risk professional. “Verify to me that they’re not,” Cronin says, “and then I can put them into the good bucket.” Without automation and workflow, he warns, “we’re literally chasing ghosts”.

ProcessUnity pulls together external scans, financial, firmographic and technographic data to show what a supplier looks like to an outsider, then pairs it with a controls-based risk index that reveals how well the supplier manages risk internally. The aim, Cronin stresses, is to help suppliers improve, not merely to rank them. “It’s about making the ecosystem safer for all of us.”

Supplier Risk Questionnaires

Anyone who has completed a supplier questionnaire will recognise Cronin’s next point. He says some clients now send questionnaires of 300 questions or more, with branching logic running to 600. His advice to suppliers is blunt: “Stop filling out questionnaires.” Instead, he says, secure automation can pre-populate answers from documents a supplier has already provided. Risk teams can then check those answers against external data and ask for evidence only where something looks wrong. The aim is “fewer questions and better questions”. The test is no longer whether a vendor returned its form but whether the two sides have talked about the risks that matter.

Human Oversight in AI Risk Assessment

None of this, Cronin insists, means handing judgement to machines. “A human in the loop is a critical part of our conversation with clients.” AI can handle the routine reading and clear lower-tier suppliers quickly. That leaves risk managers to dig into critical vendors and to spot those that looked moderate-risk on paper but could cause real harm.

The exposure also extends past direct suppliers. A firm with 10,000 vendors, Cronin says, might have 40,000 fourth and fifth parties it knows nothing about. Mapping them reveals regional concentration and hidden dependencies, and it sometimes startles the suppliers themselves. “Wow, you know a lot about me before I even know it,” is a common reaction.

Third-Party Risk Is Now a Boardroom Issue

For organisations still relying on spreadsheets and periodic reviews, Cronin’s advice is to treat third-party risk as “a live signal” and to act on it according to how important each vendor is. The subject, he adds, has moved beyond the CISO and the chief procurement officer to the boardroom, because everyone now understands how interconnected they are. “You need to use data, you need to use AI, but you need to actually use the humans that are risk professionals,” he says. Listen to the full episode of the Security Strategist Podcast for the complete conversation. Or, if you would like to find out more, visit the ProcessUnity website or follow Sean Cronin on LinkedIn.

Takeaways

• Why annual assessments can no longer keep pace with evolving supplier and AI-driven risks.
• How continuous monitoring identifies vulnerabilities and verifies actual vendor exposure.
• Combining external scanning and business data to build a clearer picture of vendor risk.
• Using SBOMs as risk indicators, supported by evidence and mitigation controls.
• Reducing alert fatigue by prioritising critical vendors and high-impact relationships.
• Automating questionnaires and evidence collection to improve risk assessments.
• Balancing automation with human oversight and informed decision-making.
• Mapping fourth- and fifth-party relationships to uncover hidden dependencies.
• Why third-party risk is now a board-level operational resilience concern.