Collaboration with vendor owners involves a lot of day-to-day activities, spanning across the three stages of the third-party risk management lifecycle. This podcast outlines useful tips that can improve collaboration between your third-party risk management team and your vendor owner.

Tips to Improve Collaboration With Vendor Owners

Learn best practices that should be included in your third-party risk management program to ensure you keep your organization protected from data breaches and other cybersecurity incidents.

Drafting Cybersecurity Requirements Into the Vendor Contract

Third-Party Risk Management and Legal Perspective

Assessing generative AI risks now – especially those involving third parties – can protect businesses from compliance problems down the road.

Juliana Neelbauer, a member of our Artificial Intelligence Practice, is joined by cybersecurity consultant Matt Mettenheimer (Associate Director, S-RM) for this practical conversation. Together, their shared points of view provide a detailed look at what business should consider when using generative AI and related cyber risks when working with third-party vendors.

AI Talk Juliana Neelbauer

Cybersecurity experts Heather Noggle and Dr. Arun DeSouza discussed Kiteworks' Data Security and Compliance Risk: 2025 Annual Survey Report, which introduces the industry's first quantitative risk scoring algorithm. The comprehensive study of 461 organizations reveals that 46% now operate in high- to critical-risk territory, with the median enterprise scoring 4.84 on a 10-point scale—dangerously close to the high-risk threshold of 5.0.

The experts analyzed a counterintuitive finding about third-party risk management: Organizations managing 1,001-5,000 external partners face the highest security risk (average score 5.19), surpassing enterprises with over 5,000 third-party relationships. These larger enterprises can monitor risks in real time, while mid-sized partner ecosystems struggle with enterprise-level complexity on mid-market budgets—resulting in 24% experiencing 7+ annual security incidents.

Industry-specific findings revealed surprising risk disparities. Energy topped the risk charts due to legacy IoT devices and 30-year-old technologies vulnerable to exploitation. Technology ranked second, which Noggle attributed to the "overconfidence factor" and rapid employee turnover. "Tech companies are losing people so fast, they want to implement things so fast. That to me is a perfect storm," DeSouza noted. Conversely, heavily regulated sectors like life sciences demonstrated lower risk scores due to compliance-driven security investments.

The report exposed a dangerous "confidence paradox" where organizations claiming to be "somewhat confident" in data governance showed 19% higher risk scores than those acknowledging uncertainty.

AI governance emerged as a critical vulnerability. While 64% of enterprises track AI-generated content (up from 28% in 2024), only 17% have deployed technical governance frameworks. The stakes are high—the IBM Cost of a Data Breach Report found that 97% of AI-related breaches lacked proper controls, with AI breaches costing $670,000 more than average. 

Poor data visibility creates cascading failures: Organizations unable to count their third parties showed 46% correlation with unknown breach frequency, while 31% of those with 5,000+ partners take over 90 days to detect breaches.

Heather Noggle: https://www.linkedin.com/in/heathernoggle/ 
Arun DeSouza: https://www.linkedin.com/in/arundesouza/ 


2025 Annual Survey Report: AI and Third-Party Security Danger Zone

Kitecast features interviews with security, IT, compliance, and risk management leaders and influencers, highlighting best practices, trends, and strategic analysis and insights. Kitecast is cohosted by Tim Freestone and Patrick Spencer who have more than four decades of combined experience in technology and cybersecurity senior leadership roles.

Fox Rothschild LLP is a national law firm with over 1000 attorneys coast to coast. Our lawyers provide a full range of legal services to public and private companies – from family-run businesses to multinational corporations. We also represent charitable, medical and educational institutions both in the United States and in more than 50 countries worldwide. In our podcasts, the attorneys of Fox share their insight and knowledge on some of today’s most pertinent legal issues impacting individuals and businesses.

Venminder has a team of due diligence experts who can significantly reduce your vendor management workload. Venminder also has a software solution to organize, track and report findings to Senior Management, the Board of Directors and, ultimately, the examining bodies.

New tracks tagged #Third-party Risk Management