White Papers

July 9, 2026

Meeting BNM RMiT 2025: A Guide to Third-Party & Supply Chain Cyber Risk Requirements

On 28 November 2025, Bank Negara Malaysia issued one of the most significant overhauls to Malaysian financial sector cybersecurity regulation in recent years. The revised Risk Management in Technology (RMiT) policy expands who’s in scope, mandates continuous monitoring of third-party vendors, introduces SBOM requirements, and enforces stricter SLAs for incident disclosure and remediation. This white paper breaks down what changed, what it means for your third-party risk program, and how to operationalise and evidence the new obligations at scale. 28 Nov 2025 — the date RMiT was revised and reissued by BNM New entities in scope — including certain non-bank merchant acquirers and intermediary remittance institutions Continuous monitoring now mandatory — periodic, questionnaire-based assessment is explicitly no longer sufficient 12M+ entities rated across SecurityScorecard’s global intelligence network RMiT 2025 isn’t a checkbox exercise. It’s a shift in how cyber risk is governed.

May 18, 2026

TPRM: De la gestion statique au pilotage en temps réel

Moderniser la gestion des risques tiers grâce à l’IA et à la Threat Intelligence Pendant des décennies, la gestion des risques tiers (TPRM) s’est résumée à un exercice statique, réalisé à un instant précis, par fichiers et questionnaires interminables. Mais aujourd’hui, cette approche constitue un risque opérationnel majeur. À mesure que se multiplient les dépendances, une seule vulnérabilité enfouie dans une bibliothèque logicielle peut déclencher une panne mondiale en quelques secondes. Alors que 90 % des responsables cyber se disent convaincus de leur résilience, à peine 22 % des programmes TPRM internes évaluent plus de la moitié de leur écosystème de fournisseurs. Pour combler cet écart, les organisations doivent abandonner la conformité réactive au profit d’une intelligence continue, où les données en temps réel et l’analyse prédictive remplacent l’audit annuel obsolète. Téléchargez ce guide pour découvrir: Les trois piliers du TPRM moderne : intégrer la télémétrie en temps réel, les signaux issus des adversaires et une orchestration pilotée par l’IA pour dépasser la conformité purement statique. Réduire drastiquement les délais d’intégration : réduire le temps d’intégration d’un nouveau fournisseur de 42 jours à seulement 42 heures, grâce à l’automatisation et le pré-remplissage intelligent, pilotés par l’IA. La Threat Intelligence comme multiplicateur de force : Associer une vision externe (Outside-In) à une vision interne pour identifier en temps réel les expositions zero-day et les risques de concentration. Le virage agentique : évoluer vers des agents IA capables de surveiller les risques de manière autonome et de déclencher des demandes de remédiation sans intervention humaine.

May 4, 2026

TITAN MAX Service

TITAN MAX inserts technology and expertise at every stage of the vendor lifecycle to drive TPRM outcomes.

April 29, 2026

A Guide to Achieving Threat-Informed Third-Party Risk Management

This solution guide serves as the strategic roadmap for high-maturity organizations ready to evolve their Third-Party Risk Management (TPRM) program from an “always-on” monitoring function to a proactive, threat-informed defense engine. You will learn how to move beyond reacting to grade drops and gain the ability to act on finished intelligence that anticipates and stops attacks before they ever reach your network. This guide is essential for organizations aiming to unify security operations and transform supply chain risk into a quantified business metric. This guide will breakdown: The threat data silo: Discover how to unify your SOC and TPRM teams by contextualizing global threat intelligence with specific business risk data. Prioritizing response via intelligence: Master the shift from chasing every alert to focusing exclusively on vulnerabilities currently being targeted by active threat actors. Executing independent risk actions: Empower your team to restrict access or switch suppliers based on data, without waiting for a vendor to respond. Quantifying exposure: Move from letter grades to financial risk and the Breach Susceptibility Index (BSI), translating technical risk into business impact language. Operational authority: Institutionalize the mandate for TPRM to pull internal levers autonomously, ensuring business continuity by taking preventative action in hours, not weeks.

April 29, 2026

How to shift from Periodic to Continuous Third-Party Risk Management

This strategic roadmap shows mature organizations how to evolve their Third-Party Risk Management (TPRM) program from static, compliance-driven cycles to an active, always-on security function. Learn how to eliminate the critical “visibility gap” that leaves you blind to emerging risks between annual reviews, moving your team from a reactive, point-in-time defense to a proactive, resilient security posture. Inside this solutions guide we have outlined: How to eliminate the critical “blind spot” caused by annual assessments and achieve 365-day oversight of your entire vendor ecosystem. A three-step framework for operationalizing a logic-based rules engine, allowing you to scale monitoring to thousands of vendors without increasing headcount. The workflows and playbooks necessary to dramatically reduce your Mean Time to Respond (MTTR) to supply chain breaches from weeks to minutes.

April 27, 2026

A Deep Dive in Scoring Methodology

Learn more in this resource.

April 15, 2026

A Guide to Building Your Core Third-Party Risk Management Program

This guide is your blueprint that helps organizations move from manual spreadsheets and ad-hoc security checks to policy-driven Third-Party Risk Management (TPRM). Learn about the core practices of Basic Diligence and how to transition to a scalable Periodic TPRM program. Inside, you will master the three essential steps to building a repeatable and scalable program: Formalize Risk Governance: Establish a policy-driven program and an audit-ready system of record, ensuring continuous compliance and liability protection. Implement Risk-Based Tiering: Strategically categorize vendors to focus high-value technical staff on critical partners, preventing low-risk ‘noise’ from clogging your pipeline. Standardize the Assessment Workflow: Implement structured digital workflows to replace manual follow-ups, achieving a standard 2-week assessment cycle time and eliminating backlogs Download the solution guide to learn about the core practices to achieve audit-readiness and operational scale without increasing headcount.

April 14, 2026

Una Guía para Construir su Programa Principal de Gestión de Riesgos de Terceros

Esta guía es su modelo de referencia que ayuda a las organizaciones a pasar de hojas de cálculo manuales y controles de seguridad ad hoc a una Gestión de Riesgos de Terceros (TPRM, por sus siglas en inglés) basada en políticas. Conozca las prácticas fundamentales de la Diligencia Básica y cómo realizar la transición hacia un programa TPRM Periódico y escalable. En su interior, dominará los tres pasos esenciales para construir un programa repetible y escalable: Formalizar la Gobernanza del Riesgo: Establezca un programa basado en políticas y un sistema de registro listo para auditorías, garantizando el cumplimiento continuo y la protección frente a responsabilidades. Implementar la Categorización Basada en Riesgo: Clasifique estratégicamente a los proveedores para concentrar al personal técnico de alto valor en los socios críticos, evitando que el “ruido” de bajo riesgo obstruya su proceso. Estandarizar el Flujo de Trabajo de Evaluación: Implemente flujos de trabajo digitales estructurados para reemplazar el seguimiento manual, logrando un ciclo de evaluación estándar de 2 semanas y eliminando los retrasos acumulados. Descargue la guía de solución para conocer las prácticas fundamentales que permiten alcanzar la preparación para auditorías y la escala operativa sin aumentar el número de empleados.

March 18, 2026

The TPRM Evolution: From Checkbox to Continuous Intelligence

Modernizing Third-Party Risk with Threat Intelligence and AI For decades, TPRM has been a static, moment-in-time exercise. But today, the legacy model of massive spreadsheets and six-week wait times is a dangerous operational liability. As Nth-party dependencies grow, a single vulnerability buried deep in a software library can trigger a global outage in seconds. While 90% of security leaders are confident in their resilience, only 22% of internal programs cover more than half of their total vendor ecosystem. To close this gap, organizations must transition from reactive box-ticking to continuous intelligence—where real-time data and predictive analytics replace the obsolete annual audit. Access this guide to discover: The Three Pillars of Modern TPRM: How to integrate real-time telemetry, adversary-focused signals, and AI-driven orchestration to move beyond manual oversight. Collapsing Onboarding Timelines: How AI-driven automation and auto-fill logic can reduce vendor onboarding from 42 days to just 42 hours. Threat Intelligence as a Force Multiplier: Leveraging outside-in and inside-out views to identify zero-day exposures and concentration risks in real-time. The Agentic Shift: Moving toward AI Agents autonomously monitoring risks and initiating remediation requests without human intervention.

June 16, 2025

Regulatory Compliance: Bridging Compliance and Cybersecurity A Comprehensive Approach to Third-Party Risk Management

Organizations are under mounting pressure to improve their cybersecurity posture and keep pace with evolving regulations and an ever-expanding network of third-party suppliers in 2025. Government and oversight bodies continue to expand the scope and specificity of regulations aimed at safeguarding sensitive information and critical infrastructure. Yet despite significant focus and investment, many enterprises struggle to keep pace.

March 25, 2025

Simplify and Automate APRA Prudential Standard CPS 230 TPRM Requirements with SecurityScorecard

Executive Summary The Prudential Standard CPS 230, issued by the Australian Prudential Regulation Authority (APRA), is a regulatory framework designed to strengthen operational risk management, business continuity, and third-party risk management (TPRM) for APRA-regulated entities, including banks, insurers, and superannuation funds. CPS 230 aims to ensure organizations have comprehensive risk management frameworks to identify, assess, and mitigate operational and third-party risks, ensuring business continuity and resilience in the face of potential disruptions. Organizations must comply with CPS 230’s requirements by July 1, 2025. CPS 230 focuses on enhancing operational resilience across financial and insurance sectors, with particular emphasis on third-party risk management to ensure service continuity and reduce risks associated with outsourced providers.

April 26, 2024

Outcome-Driven Metrics for Supply Chain Cyber Risk Management

Download the Guide The demand for cybersecurity reporting on third-party cyber risk management has never been higher. Senior executives and boards require tangible evidence that cybersecurity investments yield expected outcomes, but traditional metrics often fall short. From strategic metrics reported to the board to tactical metrics monitored within security operations, outcome-based metrics play a crucial role in demonstrating cybersecurity effectiveness. Download this guide to learn how you can build effective outcome-driven cybersecurity metrics. Some questions to consider, include: What metrics align with business objectives? How can these metrics empower executive decision-making? Which security issues pose the greatest threats to revenue?

Supply Chain Cyber Risk

April 9, 2024

Applying Machine Learning to Optimize the Correlation of SecurityScorecard Scores with Relative Likelihood of Breach

SecurityScorecard ratings provide a means for objectively monitoring the cybersecurity hygiene of organizations (including their vendors) and gauging whether their security posture is improving or deteriorating over time.

Security Ratings

April 9, 2024

SecurityScorecard’s Scoring Methodology 3.0

Take a deep dive into SecurityScorecard’s scoring methodology.

Security Ratings

March 5, 2024

A technical analysis of the APT28’s backdoor called OCEANMAP

A technical analysis of the APT28’s backdoor called OCEANMAP   Late last year, the Computer Emergency Response Team of Ukraine (CERT-UA) released an advisory that reported cyberattacks targeting state organizations attributed to the Russian espionage group APT28, aka Fancy Bear/Sofacy. The advisory listed the use of a new backdoor named “OCEANMAP.” Download this whitepaper to explore a technical analysis of APT28’s tactics, techniques, and procedures.

Cyber Threat Intelligence

Enterprise Cyber Risk

Supply Chain Cyber Risk

January 12, 2024

DORA and Cyber Risk: A New Framework for Third-Party Risk in the European Union

DORA is an effort to build resilience within the financial service sector by requiring financial services organizations to establish and monitor networks of trust amongst themselves and their ICT vendors. However, trust requires verification through monitoring and transparency.

Attack Surface Management

Cyber Threat Intelligence

DORA

January 9, 2024

Security Ratings: A New Horizon

Security Ratings Methodology for Telecommunications, Internet Service Providers, and Cloud Providers   Telecom companies, internet service providers, and cloud providers (TICPs) are a pillar of modern connectivity, linking people and companies across the globe. However, these indispensable industries are also prime targets for nationstate actors and motivated cybercrime groups. A staggering 78% of the top telecom companies in the U.S., U.K., France, and Germany experienced a third-party data breach in the past 12 months alone. These eye-opening findings emphasize the critical need for a transformative approach to cyber risk management. In light of this, SecurityScorecard, in partnership with industry leaders, is pioneering a new approach to advance security ratings for TICPs. Submit the form to download the full report.

Attack Surface Management

Cyber Threat Intelligence

Enterprise Cyber Risk

October 20, 2023

Cactus Ransomware

Learn more in this resource.

Attack Surface Management

Cyber Insurance

Cyber Threat Intelligence

February 28, 2023

Expand Your Vendor Intelligence To Identify Active Threats

Research by Ponemon Institute reports that 59% of survey respondents haveconfirmed that their organization has experienced a data breach caused byone of their third parties, with 54% of the incidents occurring in the past12 months. What is more alarming is that only 34% of organizations areconfident their suppliers would notify them of a breach that couldput their business at risk. As the global attack surface continuesto expand, it’s more important than ever to tighten and matureThird- Party Risk Management (TPRM) programs, alsoreferred to as Vendor Risk Management. Staying ahead ofweaponized vulnerabilities and threat actors targetingyour vendors’ assets decreases the chances of acyber disruption to your organization.

Attack Surface Management

Cyber Threat Intelligence

Enterprise Cyber Risk

November 10, 2022

A Look Under The Hood: Data Powering Attack Surface Intelligence

In this white paper, understand how we collect the data that powers Attack Surface Intelligence and the tools we use.

Attack Surface Management

September 14, 2022

A Detailed Analysis Of The Quantum Ransomware

Learn more in this resource.

Attack Surface Management

Cyber Insurance

Cyber Threat Intelligence