2025 Key considerations in third-party security
Third-party security is no longer a back-office function, it’s a strategic discipline shaping enterprise resilience.
Third-party security has become a critical component of enterprise risk management, playing a more central and strategic role in 2025. As organizations continue to rely on vendors and services, the nature of risk is evolving, introducing new challenges that traditional oversight models weren't designed to address.
From AI-driven services to quantum-era threats, emerging technologies are introducing new risks and regulatory pressures that demand new approaches. Some of the key drivers of integrated TPS within TPRM and the broader organization are:
1
Regulatory pressure: DORA and NIS2:
New EU regulations, such as DORA and NIS2, are reshaping how organizations manage third-party risk, emphasizing accountability, resilience, and continuous oversight.
2
Using AI to drive efficient and effective third-party security:
AI is being leveraged to improve third-party security by automating manual tasks, predicting breach risk, and detecting anomalies in vendor behavior.
3
Securing against third-party AI risk:
As vendors embed AI into their products and services, organizations are inheriting new risks related to privacy, ethics, and operations. Leading organizations are evaluating how AI is used by their vendors and implementing controls to mitigate these risks.
4
Third party quantum risk:
The emergence of quantum computing poses a significant threat to third-party security, particularly for sensitive data that must remain confidential over a long period. Organizations must assess their vendors' readiness for post-quantum cryptography.
5
Continuous monitoring and oversight:
Traditional third-party programs have relied on scheduled assessments, but as third-party environments evolve rapidly, that cadence is becoming inadequate. Leading organizations are adopting continuous monitoring to surface emerging risks and trigger early intervention.
6
Cross-functional governance and alignment:
Effective third-party security requires collaboration across functions, including procurement, IT, legal, and security. Leading organizations are establishing cross-functional governance to evaluate vendors holistically and align third-party security with broader enterprise risk strategy.
Dive into our thinking:
2025 Key considerations in third-party security
To learn more about these critical themes and how your organization can stay ahead, download the full KPMG thought leadership piece.
Download PDFMeet the team
