Understanding Vendor Risks in Financial Services
In today's fast-paced financial landscape, organizations face significant challenges related to vendor risks. A new report reveals that a staggering 92% of third-party vendors received low scores in terms of information disclosure, indicating deep-rooted issues in the management of sensitive information. As financial institutions strive to enhance their cybersecurity measures, the vulnerabilities lurking within the vendor ecosystem must be addressed effectively.
Insight into the Research Findings
The report, leading the way in cyber third-party risk intelligence, emphasizes the ever-evolving cyber threat landscape within the financial sector. The findings show that while banks and financial institutions have made strides in strengthening their defenses, third-party vendors often lack similar protections. This disconnect provides attackers with a method to gain indirect access to the financial institutions they support.
Decreasing Direct Attacks but Rising Indirect Risks
Ferhat Dikbiyik, Chief Research and Intelligence Officer at Black Kite, states that even though direct attacks on the industry are on the decline, the financial sector remains vulnerable due to its reliance on third-party vendors. The security measures in place within these vendor companies are often not on par with those of financial institutions. Therefore, when breaches occur, they can have widespread consequences.
Analysis of Ransomware Attacks
The report notes a decrease in successful ransomware attacks against the financial sector, from 191 disclosed victims in a previous year to just 55 as of mid-2025. This reduction can be attributed to several factors, including advancements in security protocols and the disbandment of major ransomware groups. However, the emergence of less sophisticated attackers and Ransomware-as-a-Service (RaaS) solutions poses a new threat, as many in the industry are not equipped to handle these opportunistic assaults.
Key Findings of the Report
The report provides essential insights into the current state of vendor risks faced by financial institutions:
- Shifting Attack Dynamics: There is a noticeable trend where attackers are moving away from targeting institutions directly and are instead exploiting the vulnerabilities in third-party vendors. Data indicates that 65% of these vendors are not up to date with their software patches, exposing financial institutions to known risks.
- Pervasive Cybersecurity Weaknesses: A considerable number of vendors have been found to possess critical security weaknesses, such as outdated systems and credential exposures. Researchers discovered that 31 out of 140 vendors had critical vulnerabilities, underscoring the urgent need for improved cybersecurity measures within the vendor community.
- Impact on Supply Chains: The vulnerabilities of vendors can ripple through to financial companies, leading to significant risks even from non-cyber incidents. For example, an attack targeting unpatched systems caused operational disruptions across various sectors linked to financial supply chains, highlighting the interconnected nature of services.
- Adapting to New Realities: As the number of direct ransomware attacks continues to fall, institutions must recognize the dangers present through their vendor partnerships. Establishing stronger vendor risk management strategies can better safeguard assets and resources.
Adopting a Proactive Approach to Vendor Risk Management
The evolving threats necessitate a proactive, intelligence-led approach to vendor risk management. Financial institutions must enhance their oversight and mitigation efforts concerning third-party risks. By doing so, they can fortify their cybersecurity posture and protect the broader financial ecosystem.
Frequently Asked Questions
What does the report highlight regarding vendor risks?
The report reveals that 92% of third-party vendors scored poorly in managing sensitive information, indicating systemic issues that need addressing.
How have ransomware attacks against the financial sector changed?
There has been a decrease in direct ransomware attacks, dropping from 191 in the previous year to 55 as of mid-2025, largely due to better security measures.
What should financial institutions do to mitigate risks?
Institutions should adopt a proactive, intelligence-driven approach to managing vendor risks, ensuring their cybersecurity measures extend throughout their supply chains.
What vulnerabilities did the report identify in vendor companies?
Many vendors displayed critical vulnerabilities such as outdated systems and patch management issues, exposing their financial partners to threats.
Why are attackers targeting third-party vendors instead of financial institutions directly?
Attackers are leveraging weaker links within the financial ecosystem, finding it more effective to exploit third-party vendors who may have less stringent security measures in place.
