RiskRecon, a Mastercard Company, and the Cyentia Institute published “From Uncertainty to Understanding: The Value of Better Data in Third-Party Risk Assessments.” To help organizations choose the best data to power their third-party risk models, RiskRecon partnered with Cyentia Institute to conduct the research study that quantifies how high-fidelity data turns risk assessments from an exercise of uncertainty to one of understanding.

The Uncertainty to Understanding research report examines the value of data that drives security assessments and presents four models for evaluating vendor risk posture based on a sample of nearly 40,000 firms from RiskRecon's dataset. The research aims to address the following two questions:

• What information is most valuable and trustworthy to measure third-party risk?
• Is there a better way to get the information you need to measure third-party risk at scale?

Using empirical research methods, Risk Recon and Cyentia Institute were able to identify the highest-value data categories and compare the power of different models in how they measure which vendors represent the greatest risk to sourcing organizations. 

Key takeaways: 

• Industry-specific models only explain 2.8% of a firm’s risk posture.
• Vendor risk assessments based on the full range of technical data collected by RiskRecon provide 22X greater power for predicting risk posture than other models tested
• Smaller businesses (10-100 hosts) are more likely to have important findings on their most critical assets compared to larger peers (1,000-10,000 hosts).
• The software industry is more likely to be better at managing its critical assets than firms with similar technical profiles (number of hosts, geolocations, etc.) in the manufacturing industry.

Third-party risk practitioners recognize that security assessments are difficult. The process of onboarding and verifying the cybersecurity posture of another organization is typically a manual process that does not yield in-depth answers that truly measure how secure a firm's environment is. Third-party risk management (TPRM) typically requires triaging a large number of vendors and making critical supply chain risk decisions based on imperfect information.

A recent research report from RiskRecon and Cyentia Institute found that 85% of security professionals don't believe the responses they receive from vendor questionnaires. This study shows that using a full range of technical insight offers 22X greater power for predicting risk posture than traditional assessment models. The “From Uncertainty to Understanding" report does not advocate for the removal of security questionnaires, rather it is intended to help firms save time on TPRM by strategically considering the data that is most valuable to their TPRM program.