IDC Spotlight, sponsored by SecurityScorecard
A 2026 IDC Spotlight shows why point-in-time vendor risk assessments can no longer keep pace – and what continuous, threat-informed TPRM looks like in practice.
As noted in the IDC Spotlight, the 2026 Verizon Data Breach Investigations Report (DBIR) puts third-party involvement in breaches at 48%, up 60% year over year — a sharper climb than the prior two years combined. In IDC’s Third-Party Risk Management Software Survey from August 2026 of 1,226 organizations using TPRM software, when asked to characterize their overall assurance method, only 16.2% describe continuous monitoring — security ratings, attack surface monitoring, and breach and vulnerability intelligence feeds — as the model in use.
Get the full IDC Spotlight to learn:
- Why 30.9% of organizations say they are likely to switch TPRM software providers within the next 18 months (IDC’s Third-Party Risk Management Software Survey, August 2026)
- Why IDC believes continuous, threat-informed TPRM — built on inside-out telemetry, API-based data collection, and risk scoring tied to business context — will keep displacing point-in-time assessment as the baseline operating model over the next several years, and that the endpoint of this shift is a TPRM life cycle that is more than 90% automated, with analysts reviewing machine-generated findings rather than producing them by hand.
Get the excerpt
