Smart Firms Treat Vendor Risk Like Their Own – PYMNTS.com

Highlights
Advanced AI models are rapidly uncovering vulnerabilities across enterprise supply chains, making third-party software and vendors the weakest link rather than internal systems.
Even as companies improve internal defenses, interconnected ecosystems mean a single vendor’s delay or flaw can expose the entire organization, while attackers increasingly exploit these indirect entry points.
Traditional practices like periodic audits and patching are no longer enough — firms must adopt real-time monitoring, faster response cycles, and deeper oversight of vendor security to keep up with evolving threats.
Artificial intelligence has opened up Pandora’s box for enterprise cybersecurity. And what it found was that the modern enterprise is no longer a closed system. It is a web of dependencies, stitched together by software vendors, cloud providers, and outsourced engineering partners.

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.






yesSubscribe to our daily newsletter, PYMNTS Today.
By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.


Δ
Increasingly, this means the weakest link isn’t one that’s found inside the organization at all but instead resides across the long tail of third-party software that keeps operations running. That may be old news to some in the C-suite, but what’s new news is how fast latent vulnerabilities across a corporate supply chain can be surfaced, thanks in large part to emerging frontier AI models, like both Anthropic’s Mythos and OpenAI’s GPT 5.4 cyber model, and their user-agnostic capabilities for cyber exploitation.
In response to today’s dynamic and evolving threat landscape, Microsoft recently (April 14) patched over 167 existing security vulnerabilities in its Windows operating systems and related software with new updates.
Vulnerabilities that might once have lingered undetected for months are now surfaced in days, sometimes hours. In parallel, attackers are becoming more opportunistic, scanning not just primary targets but their extended ecosystems for entry points.
But in a world of interconnected systems, patch discipline is only as strong as the weakest vendor.
See also: What AI-Driven Attack Chains Mean for CFOs and CISOs 
Advertisement: Scroll to Continue
Cybersecurity has always been described as a moving target. What distinguishes the current moment is how quickly yesterday’s best practices are becoming today’s minimum requirements. Patch discipline, vendor audits, and incident response planning are no longer differentiators; they are table stakes.
PYMNTS covered Monday (April 27) how hackers have reportedly begun impersonating Microsoft Teams help desk workers to dupe victims into installing data-stealing malware. These attacks are part of a larger trend PYMNTS covered last week, one that sees hackers “logging in” rather than breaking in.
The result is a paradox: even as internal defenses improve, overall risk can increase because the attack surface has expanded beyond direct control. A vendor’s delayed patch cycle or misconfigured system can become the enterprise’s problem overnight.
For CFOs, this introduces a category of risk that is both material and difficult to quantify. Unlike traditional operational risks, third-party vulnerabilities are often opaque, buried in contractual relationships that may have been primarily negotiated for cost efficiency or speed rather than cyber resilience.
The PYMNTS Intelligence report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms” found that hackers are increasingly going after middle market firms, which depend on third-party cloud providers, software-as-a-service platforms, managed service and logistics providers, which can leave them vulnerable to attack.
As a result, the predictable rhythms of enterprise IT maintenance are increasingly misaligned with the pace of modern threats. Vulnerabilities disclosed today can be weaponized tomorrow. If a vendor takes weeks to deploy a fix, that lag becomes a window of exposure not just for them, but for every client connected to their systems.
See also: FBI Warns: Internal Risk May Outpace Cyber Threats 
Third-party risk is no longer a niche compliance concern. It is becoming the frontline of defense.
As cybersecurity becomes more intertwined with enterprise value, the CFO’s role is expanding. This does not mean becoming a technical expert. It does mean asking sharper questions. How quickly do our critical vendors patch known vulnerabilities? What visibility do we have into their security practices? How are we prioritizing investments in vendor risk management relative to other initiatives?
Data, in this environment, is becoming critical to powering real-time visibility. CFOs can embrace strategies such as automated scanning, continuous monitoring, and predictive analytics to provide a more dynamic view of a partner’s security posture.
“The lagging organizations treat the data as a storage problem while the leading organizations actually treat it as a decisioning system,” Max Spivakovsky, senior director of global payments risk management at Galileo, told PYMNTS in an interview posted this month for the “What’s Next in Payments” series.
See also: Cybersecurity’s Hottest New Job Is Negotiating With Hackers
But perhaps the most profound shift is a conceptual one. Third-party risk management is moving from a periodic, compliance-driven exercise to a continuous process. Annual audits and questionnaires are no longer sufficient in a landscape where vulnerabilities can emerge and evolve rapidly.
After all, AI isn’t the only vulnerability high-value enterprise firms and institutions are facing. In other cybersecurity news, PYMNTS wrote earlier about the way Quantum Day — the moment when commercially available quantum computers can crack widely used cryptographic systems — has ceased being a distant hypothetical.
“As a result of the shrinking strategic horizon, what was once a theoretical, deep-tech risk is instead now being operationalized into present-day procurement decisions, product roadmaps and compliance mandates,” that report said.
Smart Firms Treat Vendor Risk Like Their Own
Polymarket Seeks End to CFTC Trading Ban
OpenAI Joins Amazon Bedrock After New Agreement With Microsoft
Amazon Transforms Audio Summaries Into Interactive AI Dialogues
Get PYMNTS Today, AI, B2B and more.
We’re always on the lookout for opportunities to partner with innovators and disruptors.

source
This is a newsfeed from leading technology publications. No additional editorial review has been performed before posting.