2026 Study from Panorays: 85% of CISOs Can’t See Third-Party Threats Amid Increasing Supply Chain Attacks – Latest Hacking News

9.1K

New York, NY, January 14th, 2026, CyberNewsWire

Panorays, a leading provider of third-party security risk management software, has released the 2026 edition of its annual CISO Survey for Third-Party Cyber Risk Management. 

The survey underscores third-party cyber risk as a critical challenge for security leaders, primarily due to a lack of visibility. While 60% of CISOs report an increase in third-party security incidents, only 15% claim to have full visibility into these risks.

These gaps are exacerbated by limited resources and technology stacks ill-equipped to handle dynamic supply-chain threats at scale.

Based on feedback from 200 CISOs of US-based companies, the 2026 Panorays CISO Survey sheds light on cybersecurity executives’ ongoing struggles to fortify software supply chain security. Resource constraints and inadequate tech stacks further hinder these efforts. Despite increased adoption, traditional Governance, Risk, and Compliance (GRC) platforms have largely disappointed security teams, leaving them without the necessary tools or confidence to effectively combat the growing wave of third-party threats.

Key Insights from the Survey

• Preparedness is alarmingly low: While 77% of CISOs view third-party risk as a major threat, only 21% have tested crisis response plans in place. This indicates that organizations are increasingly vulnerable to prolonged outages, exposure of sensitive systems, financial losses in the event of a breach, and compliance violations. Without a solid response plan, even minor incidents could escalate into major crises.
• Most organizations are unaware of their vendors: Despite 60% reporting an increase in third-party breaches, only 41% actively monitor risk beyond direct suppliers. CISOs face significant blind spots, as they focus primarily on visible risks while potential threats lurk in the background, unnoticed by many security teams.
• Shadow AI poses new attack vectors: Despite rapid AI adoption, only 22% of CISOs have formal vetting processes, allowing unmanaged third-party AI tools to infiltrate core environments. The rapid adoption of black-box AI tools outpaces security teams’ ability to keep up, with 60% of respondents identifying shadow AI as a major risk. This creates a dangerous blind spot for CISOs, as high-risk third-party systems gain access to IT environments without adequate scrutiny.
• CISOs express dissatisfaction with their compliance platforms. The report reveals that 61% of businesses have invested in GRC software solutions, yet 66% find these platforms ineffective in addressing the dynamic nature of external third-party supply chain risks. Consequently, security teams resort to manual workarounds, increasing the likelihood of overlooking vulnerabilities.
• Traditional security assessments fall short: A consensus is emerging among CISOs, with 71% acknowledging that standard questionnaires do not provide sufficient insight into the threat landscape, leading to fatigue rather than clarity. Fortunately, CISOs are increasingly turning to AI-driven assessment tools, with 66% making the transition.