Third-party risk is now a regulatory obligation

Ask a procurement team how they assess supplier security and you will get a familiar answer: a questionnaire, a score, a review cycle, a folder. Ask a regulator the same question and the answer is different, because the question is different. The regulator is not asking whether you assessed the risk. It is asking you to evidence that you monitor it.

That distinction — assessment versus continuous monitoring — is where most third-party programmes quietly fail.

What the regulation actually changed

DORA, the EU's Digital Operational Resilience Act, applies to financial entities and their critical ICT third-party providers. Its logic is deliberately unfashionable: resilience is an outcome of the whole chain, not of the regulated entity at the top of it. That means contractual requirements, register of information obligations, incident reporting that reaches into providers, and testing that assumes the provider may be the vector.

NIS2 extends comparable expectations across a much wider set of essential and important entities, with management-body accountability attached. Across the GCC, national cyber authorities have been moving in the same direction, with sector regulators layering their own requirements on top.

None of these regimes asks whether you sent a questionnaire. They ask whether you have identified your dependencies, assessed concentration, and can demonstrate ongoing oversight. A static score from a completed form does not answer any of the three.

The evidence from the last twelve months

Supply-chain compromise is no longer an exotic scenario; it is the standard operating procedure.

• October 2026: attackers abused a compromised credential associated with ConnectWise Cloud Backup, formerly SkyKick, to reach customers' Microsoft 365 environments — a textbook case of a trusted integration becoming the access path.
• 2026: in a case documented by Anthropic's threat intelligence team, an actor used a cross-site scripting flaw to compromise a SaaS vendor, escalated privileges, and exfiltrated data from thousands of downstream customer organisations — using AI assistance to understand developer and authentication APIs and to build bulk export tooling.
• 2025: the Salesforce-related breach reported to have affected hundreds of companies and more than 4.4 million individuals; Qantas, where six million customer records were exposed; and a ransomware attack on Asahi Group Holdings reported to have cost more than £9 million per day of disruption.

The pattern is consistent. The compromised party is rarely the target. It is the door.

Your supplier's security posture is not a document they sent you. It is a live, changing, externally observable fact about their infrastructure — and it changes the week after you sign off on it.

What continuous monitoring looks like when it is done properly

Third Party Risk Intelligence, as implemented in ThirdWatch, takes an evidence-based approach rather than a declarative one: producing a list of observed threats against a supplier's external estate, scored on observed activity, proximity and escalation, and rolled into a net score weighted by the operational importance of that supplier to you.

Three practical differences from a questionnaire programme:

1. It notices change. New hostile infrastructure directed at a supplier, a sudden escalation in adversarial interest, a domain that has quietly started resolving somewhere it should not — these are events, and events can be alerted on. A questionnaire refresh cycle cannot see them.
2. It ranks by consequence. Every organisation has more suppliers than it can monitor equally. Weighting by operational importance and by concentration risk is not a refinement; it is the only way the programme is affordable.
3. It produces evidence. Observed activity, dated, attributed and mapped to the supplier register is exactly the artefact a regulator or an auditor asks for, and exactly what a risk committee needs to make a decision.

The concentration problem nobody wants to raise

There is a harder truth underneath this. Most organisations in the region depend on a small number of cloud, identity, payments and managed-service providers. You cannot diversify away from your identity provider. You cannot meaningfully exit your core banking platform on a quarter's notice.

So the honest framing is not “reduce third-party risk”. It is: know which dependencies you cannot exit, and monitor those hardest, because for them monitoring is the only control you have.

That requires an inventory most organisations do not have in usable form — which is usually where a DORA or NIS2 readiness exercise starts, and why the first finding is almost always about the register rather than the technology.

Where to start

Three steps that produce value before any platform decision:

• Build the dependency register to the level of operational importance, not to the level of procurement convenience.
• Identify the ten suppliers whose failure would be existential, and treat their external threat exposure as part of your own estate.
• Replace the annual questionnaire with a monitoring cadence, and keep the questionnaire for the things monitoring cannot see — contracts, sub-processors, internal controls.

Blueridge supports financial entities and their suppliers on DORA and NIS2 readiness, third-party risk programmes and the evidence trail regulators now expect.