GITNUXREPORT 2025

Third Party Risk Statistics

Most organizations face serious third-party risks, causing costly security breaches.

Jannik Linder

Co-Founder of Gitnux, specialized in content and tech since 2016.

First published: April 29, 2025

Our Commitment to Accuracy

Rigorous fact-checking • Reputable sources • Regular updatesLearn more

Statistic 1

The average cost of a data breach caused by a third-party vendor is $4.3 million

Statistic 2

64% of third-party vendors have experienced a security incident

Statistic 3

83% of organizations have experienced a security incident involving third-party vendors

Statistic 4

55% of organizations had a supply chain disruption due to third-party vendor failure in the past year

Statistic 5

45% of organizations experience operational disruptions due to third-party vendor failures

Statistic 6

58% of organizations have experienced challenges with third-party onboarding processes

Statistic 7

59% of organizations do not have a comprehensive third-party risk management program

Statistic 8

Organizations with mature third-party risk management programs are 50% less likely to experience material third-party breaches

Statistic 9

44% of organizations lack real-time monitoring of their third-party vendors

Statistic 10

Only 36% of organizations conduct ongoing third-party risk assessments

Statistic 11

78% of organizations view third-party risk as a significant threat to their overall security posture

Statistic 12

60% of third-party vendors involved in a breach could have been prevented with better contractual risk management

Statistic 13

89% of cybersecurity leaders think third-party risks are increasing in severity

Statistic 14

Organizations spend an average of 270 hours annually managing third-party risk for each vendor

Statistic 15

69% of organizations say third-party risk management affects their overall cybersecurity strategy

Statistic 16

65% of organizations have identified critical third-party vendors as high risk

Statistic 17

Over 90% of organizations believe third-party risk will increase over the next 12 months

Statistic 18

85% of organizations believe their third-party risk management program needs improvement

Statistic 19

49% of organizations do not verify the security controls of vendors regularly

Statistic 20

37% of organizations lack a formal third-party risk management policy

Statistic 21

54% of organizations struggle to assess the security posture of new vendors

Statistic 22

81% of organizations have experienced a third-party security breach

Statistic 23

63% of data breaches are caused by third-party vendors

Statistic 24

43% of third-party breaches originate from non-IT vendors

Statistic 25

68% of companies modify their cybersecurity policies after third-party incidents

Statistic 26

52% of third-party vendors access organizations' sensitive data regularly

Statistic 27

71% of third-party vendors do not have adequate cybersecurity insurance coverage

Statistic 28

79% of third-party vendors are not compliant with industry-specific regulations

Statistic 29

only 29% of third-party vendors are subject to thorough security audits

Statistic 30

73% of third-party cybersecurity incidents are linked to inadequate vendor security protocols

Statistic 31

58% of third-party vendors do not include cybersecurity requirements in their contracts

Statistic 32

80% of third-party vendors have security gaps that could be exploited

Statistic 33

66% of organizations lack visibility into the security posture of their third-party vendors

Statistic 34

54% of organizations experienced difficulty in enforcing security policies on third-party vendors

Statistic 35

42% of third-party breaches involve misconfigured cloud services

Statistic 36

67% of organizations outsource parts of their cybersecurity to third-party providers

Statistic 37

70% of companies have experienced some form of third-party data breach

Statistic 38

72% of third-party vendors do not have a formal incident response plan

Statistic 39

78% of organizations find it difficult to track third-party vendor compliance over time

Statistic 40

61% of third-party vendors do not provide sufficient security documentation

Statistic 41

75% of security breaches involving third parties could be prevented through better vetting

Statistic 42

52% of enterprises have limited visibility into vendor cybersecurity practices

Statistic 43

44% of third-party vendors do not regularly update their security measures

Statistic 44

77% of third-party vendors do not undergo proper security assessments before onboarding

Slide 1 of 44

Sources

Our Reports have been cited by:

Trust Badges - Publications that have cited our reports

Key Highlights

81% of organizations have experienced a third-party security breach
63% of data breaches are caused by third-party vendors
59% of organizations do not have a comprehensive third-party risk management program
77% of third-party vendors do not undergo proper security assessments before onboarding
43% of third-party breaches originate from non-IT vendors
Organizations with mature third-party risk management programs are 50% less likely to experience material third-party breaches
68% of companies modify their cybersecurity policies after third-party incidents
52% of third-party vendors access organizations' sensitive data regularly
44% of organizations lack real-time monitoring of their third-party vendors
The average cost of a data breach caused by a third-party vendor is $4.3 million
Only 36% of organizations conduct ongoing third-party risk assessments
71% of third-party vendors do not have adequate cybersecurity insurance coverage
78% of organizations view third-party risk as a significant threat to their overall security posture

With over 80% of organizations experiencing third-party security breaches and more than half lacking comprehensive risk management strategies, it’s clear that third-party risk is the ticking time bomb in today’s cybersecurity landscape.

Cybersecurity Incidents & Impact

The average cost of a data breach caused by a third-party vendor is $4.3 million
64% of third-party vendors have experienced a security incident
83% of organizations have experienced a security incident involving third-party vendors

Cybersecurity Incidents & Impact Interpretation

With over 80% of organizations facing third-party vendor-related security incidents and the staggering $4.3 million average breach cost, it’s clear that trusting third parties without robust safeguards is a risk that’s far too expensive to ignore.

Operational Challenges & Disruptions

55% of organizations had a supply chain disruption due to third-party vendor failure in the past year
45% of organizations experience operational disruptions due to third-party vendor failures
58% of organizations have experienced challenges with third-party onboarding processes

Operational Challenges & Disruptions Interpretation

With over half of organizations facing supply chain and operational disruptions from third-party failures and nearly six in ten struggling with onboarding, it's clear that managing third-party risk remains the Achilles' heel of modern corporate resilience.

Risk Management & Assessment

59% of organizations do not have a comprehensive third-party risk management program
Organizations with mature third-party risk management programs are 50% less likely to experience material third-party breaches
44% of organizations lack real-time monitoring of their third-party vendors
Only 36% of organizations conduct ongoing third-party risk assessments
78% of organizations view third-party risk as a significant threat to their overall security posture
60% of third-party vendors involved in a breach could have been prevented with better contractual risk management
89% of cybersecurity leaders think third-party risks are increasing in severity
Organizations spend an average of 270 hours annually managing third-party risk for each vendor
69% of organizations say third-party risk management affects their overall cybersecurity strategy
65% of organizations have identified critical third-party vendors as high risk
Over 90% of organizations believe third-party risk will increase over the next 12 months
85% of organizations believe their third-party risk management program needs improvement
49% of organizations do not verify the security controls of vendors regularly
37% of organizations lack a formal third-party risk management policy
54% of organizations struggle to assess the security posture of new vendors

Risk Management & Assessment Interpretation

With 59% of organizations lacking a comprehensive third-party risk strategy amid over 90% foreseeing escalating threats, it’s clear that while cybersecurity leaders recognize third-party risks as a growing menace—spending an average of 270 hours per vendor—most are still flying blind without real-time monitoring, ongoing assessments, or formal policies, leaving them vulnerable to breaches that better strategy could have prevented.

Third-Party Security & Compliance

81% of organizations have experienced a third-party security breach
63% of data breaches are caused by third-party vendors
43% of third-party breaches originate from non-IT vendors
68% of companies modify their cybersecurity policies after third-party incidents
52% of third-party vendors access organizations' sensitive data regularly
71% of third-party vendors do not have adequate cybersecurity insurance coverage
79% of third-party vendors are not compliant with industry-specific regulations
only 29% of third-party vendors are subject to thorough security audits
73% of third-party cybersecurity incidents are linked to inadequate vendor security protocols
58% of third-party vendors do not include cybersecurity requirements in their contracts
80% of third-party vendors have security gaps that could be exploited
66% of organizations lack visibility into the security posture of their third-party vendors
54% of organizations experienced difficulty in enforcing security policies on third-party vendors
42% of third-party breaches involve misconfigured cloud services
67% of organizations outsource parts of their cybersecurity to third-party providers
70% of companies have experienced some form of third-party data breach
72% of third-party vendors do not have a formal incident response plan
78% of organizations find it difficult to track third-party vendor compliance over time
61% of third-party vendors do not provide sufficient security documentation
75% of security breaches involving third parties could be prevented through better vetting
52% of enterprises have limited visibility into vendor cybersecurity practices
44% of third-party vendors do not regularly update their security measures

Third-Party Security & Compliance Interpretation

With over 80% of organizations falling victim to third-party breaches, it’s clear that trusting vendors without comprehensive vetting and vigilant oversight is akin to leaving your cybersecurity front door wide open—highlighting the urgent need for a more rigorous, transparent, and proactive third-party risk management strategy.

Vendor Relationships & Monitoring

77% of third-party vendors do not undergo proper security assessments before onboarding

Vendor Relationships & Monitoring Interpretation

With nearly four out of five third-party vendors passing through the onboarding process unassessed, organizations are essentially opening the digital door to potential threats without even checking the lock.