Five Strategies to Contain Third-Party Risk

When hackers breached Capita Plc’s systems in March 2023, security teams detected the intrusion within 10 minutes. Yet the UK outsourcing giant couldn’t stop the bleeding for 58 hours, enough time for attackers to siphon nearly one terabyte of data belonging to 6.6 million people. This incident exposed glaring weaknesses in Capita’s third-party risk management, highlighting how vulnerabilities in vendor and partner systems can cascade into massive data and compliance crises.

The £14 million fine that Britain’s Information Commissioner’s Office levied in October 2025 marked one of the costlier regulatory penalties in recent memory. “Capita failed in its duty to protect the data entrusted to it by millions of people,” said John Edwards, the UK Information Commissioner. “The scale of this breach and its impact could have been prevented had sufficient security measures been in place.”

The case exposed how even sophisticated organizations with robust detection capabilities can falter when third-party risk management breaks down at the containment stage. The breach compromised sensitive information from 325 pension schemes, underscoring a reality that compliance teams now confront daily: their risk perimeter extends far beyond corporate firewalls into a sprawling ecosystem of vendors, suppliers and service providers.

With 61% of companies reporting third-party breaches in the past year, a 49% jump from the previous period according to Prevalent’s 2024 Third-Party Risk Management Study, the Capita incident offers critical lessons. Here are five practical strategies compliance teams can implement to strengthen third-party risk management and avoid similar regulatory consequences.

1. Deepen Vendor Due Diligence

Continuous security ratings have transformed how organizations assess vendor risk. SecurityScorecard pioneered the approach of scoring vendor security posture based on externally observable data, scanning for exposed attack surfaces, certificate misconfigurations, and DNS health without requiring direct access to vendor infrastructure. The platform leverages passive reconnaissance techniques to monitor IP reputation, patching cadence, and leaked credentials across the dark web.

The vendor that passed muster 18 months ago may have undergone management changes, budget cuts, or infrastructure migrations that fundamentally altered its risk profile. Scheduled reassessments, quarterly for high-risk vendors and annually for others, create visibility into evolving threats before they cascade into incidents. Financial services regulators have codified these expectations through the Federal Reserve’s interagency guidance on third-party relationships, which now explicitly requires banks to implement risk-based due diligence programs that scale with vendor criticality. The 49% year-over-year increase in third-party incidents suggests other sectors would be wise to adopt similar frameworks voluntarily rather than wait for mandates.

2. Automate Third-Party Risk Management

The gap between threat detection and containment that plagued Capita represents a solvable problem, but only through technology that operates at machine speed. Yet just 5% of companies actively leverage artificial intelligence in their third-party risk programs, according to Prevalent’s research.

SIEM platforms provide the technical foundation for real-time vendor oversight. These systems ingest authentication logs, API calls, and data transfer events across vendor access points, applying behavioral analytics to establish baselines for each relationship. Machine learning algorithms correlate signals like unusual login times, data transfer volumes, or access to previously dormant systems that individually might escape notice but collectively indicate compromise.

When anomalies surface, after-hours database queries or bulk data exports for instance, automated workflows trigger alerts and initiate incident response procedures. The technology detects when vendor credentials appear in credential stuffing attacks or when vendor endpoints exhibit malware behaviors consistent with known threat actor tactics. As third-party breaches increasingly trigger eight-figure regulatory fines, organizations that fail to modernize monitoring capabilities essentially bet their compliance budgets that manual oversight will catch threats before regulators do.

3. Harden Contractual Protections

Legal agreements create the scaffolding for third-party accountability, but generic contract language provides little protection when breaches occur. Effective vendor contracts must specify technical security controls that create measurable accountability:

• Multi-factor authentication required for all privileged access, with hardware tokens mandated for administrator accounts
• Encryption at rest using AES-256 or equivalent standards, with key management protocols documented and auditable
• TLS 1.3 minimum for all data in transit, with cipher suite specifications that exclude deprecated algorithms
• Vulnerability scanning on weekly cycles, with remediation SLAs tied to CVSS scores: critical findings patched within 72 hours, high-severity within 14 days
• Network segmentation between client environments, with explicit DMZ architecture and firewall rule documentation
• Read-only API access provisioned for continuous monitoring, allowing security teams to query vendor systems without impacting operations
• Incident notification within 24 hours of discovery, with preliminary root cause analysis due within 72 hours
• Annual penetration testing by independent third parties, with full report disclosure to clients
• SOC 2 Type II attestations refreshed annually, with interim assessments triggered by infrastructure changes
• Right to audit on 48 hours’ notice, including unannounced assessments for high-risk vendors

The Federal Reserve’s guidance emphasizes that contractual clarity isn’t just good practice; it’s a regulatory expectation. Examiners increasingly scrutinize whether banks have established appropriate contractual safeguards commensurate with the risks individual vendors present. Beyond legal departments, procurement teams need training to recognize which terms matter for risk management and avoid vendor-friendly language that limits audit rights or caps liability below realistic breach costs.

4. Build Response Capabilities

62% of organizations cite understaffing as their biggest obstacle to managing third-party risks effectively, according to the 2024 Prevalent study. That resource constraint makes automated response capabilities essential rather than optional.

Palo Alto Networks’ Cortex XSOAR orchestrates response workflows across security tools when breaches occur. The platform instantly revokes OAuth tokens, disables service accounts, and isolates compromised network segments through firewall rule updates. Integration with identity providers allows immediate suspension of vendor SSO access without manual intervention, buying precious minutes when attackers are actively exfiltrating data.

Digital forensics tooling captures memory dumps from vendor-accessed systems, preserves CloudTrail logs from AWS or Azure environments, and extracts authentication records from identity management platforms. Pre-established playbooks let smaller teams execute efficiently under pressure rather than improvise during crises. Regular testing through tabletop exercises simulates breach scenarios and reveals gaps before real incidents exploit them. Organizations that haven’t tested their incident response plans against third-party breach scenarios will discover their weaknesses at the worst possible moment, when legal notification deadlines are ticking and regulators are asking pointed questions about containment timelines.

5. Strengthen Vendor Communication

The 2024 State of Third-Party Risk Report indicates that 90% of organizations now consider vendor risk management a growing priority, up from 63% in 2020. That shift reflects hard-won recognition that supply chain security demands executive attention and cross-functional coordination, but prioritization means nothing if communication remains one-directional.

Vendors need mechanisms to report concerns without fear of contract termination. Consider the vendor who discovers unauthorized access to customer data at 2 a.m. on a Friday. If their only contact is an account manager who lacks technical background, they’ll debate internally whether to report immediately or wait until Monday morning. That hesitation gives attackers 72 hours to move laterally. Organizations that establish secure channels like dedicated Slack workspaces or encrypted email distributions to security operations centers can compress incident notification from days to minutes.

Splunk’s GRC capabilities provide the technical scaffolding for this communication architecture, allowing vendors to submit security attestations, report incidents through structured intake forms, and track remediation progress against defined milestones. API integrations with ticketing systems create bidirectional visibility into security exception status and control implementation timelines. Quarterly business reviews and security committee meetings create formal channels for discussing emerging threats, but informal check-ins often surface the resource constraints or technical debt that metastasize into compliance problems before they trigger incidents.

Vendors who believe reporting problems will cost them business relationships will delay disclosure every time, precisely the behavior that transforms containable incidents into catastrophic breaches. Building trust through non-punitive escalation policies proves as important as deploying the technical infrastructure to support rapid communication.

Key Takeaways

The Capita breach crystallized lessons that compliance teams ignore at their peril. Detection capabilities matter little if organizations can’t rapidly contain threats that vendors introduce. The technology exists to manage these risks effectively, from SecurityScorecard’s continuous security ratings to Cortex XSOAR’s automated incident response and Splunk’s integrated monitoring and governance capabilities.

As regulatory scrutiny intensifies and breach costs escalate, the sophistication gap in third-party risk management will increasingly determine which organizations weather the next wave of cyber incidents and which become cautionary tales in future regulatory enforcement actions. The question is no longer whether organizations can afford to invest in comprehensive third-party risk management programs, but whether they can afford not to.