IDC just published a new Spotlight commissioned by Security Scorecard, “The Vanishing Window: Why Third-Party Risk Management Must Go Continuous,” and it validates something we’ve been arguing for a while: the annual vendor questionnaire is no longer a serious control. It’s a snapshot of a moving target, filed away until next year’s renewal.
IDC’s research puts numbers behind what practitioners already feel in their gut. In its August 2026 survey of 1,226 organizations, only 16.5% still rely on pure point-in-time assessment — but when asked to describe their overall assurance method, just 16.2% say continuous monitoring is actually the model in use. Everyone knows where they need to go. Most programs haven’t gotten there yet.
| 16.5%still rely on pure point-in-time assessment | 37.6%use continuous, API-based monitoring as primary cadence | 16.2%describe continuous monitoring as their overall model |
That gap is the whole story. And it’s exactly the gap Security Scorecard was built to close.
The threat landscape isn’t waiting for your next audit cycle
IDC’s framing is stark: threat actors, increasingly assisted by their own AI tooling, are compressing attack lifecycles from days to hours — and, on the near-term horizon, from hours to minutes. Third-party involvement in breaches is accelerating right alongside that compression. The 2026 Verizon DBIR puts third-party involvement in breaches at 48%, up 60% year over year. Our own Global Third-Party Breach report finds over 35% of breaches trace back to a third party. The methodologies differ, but the direction doesn’t: your vendors are increasingly the way in, and the window to catch a problem before it becomes a breach is shrinking in real time.
A control that refreshes once a year cannot defend against a risk that changes by the hour.
That mismatch is the core argument of IDC’s study, and it’s the reason we don’t sell ratings as a compliance checkbox. We sell them as a live signal.
We’ve been building toward “continuous and threat-informed” on purpose
The IDC study organizes the market’s evolution around a shift from periodic audits to continuous, evidence-driven, threat-informed operations. That’s not a repositioning exercise for us — it’s the literal structure of our product roadmap. We talk about TPRM maturity in four stages: Basic Diligence, Periodic TPRM, Continuous TPRM, and Threat-Informed TPRM. Most vendor risk programs today are stuck somewhere between the first two. Our job is to give customers a credible, evidence-backed path to the last one, without asking them to rip out everything they’ve already built.
That’s also why we didn’t stop at outside-in ratings. The IDC study calls out “inside-out” telemetry — evidence pulled continuously from a vendor’s own IAM, EDR, CMDB, and CSPM systems — as one of the more promising responses to the audit-effectiveness gap, and notes that API-based telemetry, rather than agentic tools operating inside a vendor’s environment, is emerging as the path vendors are actually willing to accept. That’s a trust problem as much as a technology one, and it tracks with what we hear directly from vendors asked to grant deeper access to their environments. We’d rather meet that resistance with better outside-in visibility than assume it away.
Driftnet and the attack surface you can’t question your way into
You can’t put “have you patched your internet-exposed infrastructure” on a questionnaire and trust the answer. You have to go find it yourself. That’s the thesis behind our May 2026 acquisition of Driftnet, and IDC’s study treats it as a meaningful data-asset expansion rather than a bolt-on feature. Since the acquisition, we index 40% more internet-exposed hosts than any other intelligence provider, using non-standard port enumeration, fingerprinting, and IPv6-focused discovery to surface the shadow attack surface that questionnaire-based programs are structurally unable to see. That’s the kind of finding a right-to-audit clause never uncovers, because nobody thought to ask about it.
Turning risk into a decision, not just a score
IDC’s study makes a point we think is underappreciated: continuous monitoring only matters if it changes what people actually do. A finding on an obscure subsystem and a finding on a system tied to revenue-critical data are not the same risk, and a mature program has to say so and act accordingly. That’s why our capability mapping isn’t built for a single GRC owner reading a dashboard alone — we map relevance across six stakeholder personas, from the enterprise CISO and CRO to security operations, vulnerability management, and dedicated threat intelligence teams. Third-party risk decisions increasingly touch all of them, and IDC’s own data on TPRM ownership backs that up: no single model dominates today, with responsibility split across centralized offices, cybersecurity teams, procurement, and everywhere in between. A platform that only speaks to one of those functions is solving half the problem.
The honest part: we’re not there yet either
We’d rather not cherry-pick the numbers that flatter us. IDC’s survey found only 13.4% of TPRM software users say their platform offers inside-out, right-to-audit-style scanning today, and only 15.2% report integrated threat-intelligence feeds — evidence that this whole category, us included, is still earlier in this shift than the marketing tends to suggest. IDC’s own independent survey data found 10.7% of organizations using a TPRM module report using SecurityScorecard (n=159) — a real number from a third party, not a claim we’re making about ourselves.
| The target, and the timeline. IDC believes the endpoint of this shift is a TPRM lifecycle that’s more than 90% automated within the decade, with analysts reviewing machine-generated findings instead of producing them by hand. We think that’s the right target, and we think getting there is a multi-year build, not a feature release. |
The organizations that start moving from periodic to continuous now — before the window closes further — are the ones who’ll have a defensible, evidence-based posture to bring into the board, regulator, and cyber-insurance conversations that are coming whether TPRM programs are ready or not.
Data cited: IDC Spotlight, sponsored by SecurityScorecard, The Vanishing Window: Why Third-Party Risk Management Must Go Continuous, #US54928026, September 2026
