The 2025 TPRM Study: Key Findings and Recommendations

The study, which surveyed professionals across various industries and company sizes, highlights a sector at a pivotal crossroads, where shifts in the regulatory climate, technological adaptation, and operational imbalance threaten the health of the system.

Below, we explore the study’s key findings and what they reveal about the state of today’s third-party ecosystems — and how resilient organizations are cultivating stronger, more balanced risk environments.

Finding #1: Understaffed and Underprepared: A Resource Crisis

In any ecosystem, a shortage of caretakers and an overgrowth of unchecked species can lead to imbalance. In TPRM, this is reflected in nearly 70% of teams reporting understaffing, with an almost 30% gap between existing and ideal team sizes. As a result, organizations are only managing about 40% of their vendor population.

Like an unmanaged forest with competing lifeforms, a lack of coordination exacerbates risk. Fewer than 25% of programs are “highly coordinated,” and nearly half cite departmental silos as a major barrier. Risk ownership is fragmented: infosec and risk teams oversee strategy, procurement manages the vendor database, and business units maintain day-to-day relationships, often with little cross-talk.

Implication: Without aligned stewardship, the third-party ecosystem becomes tangled. To thrive, organizations must coordinate roles and foster shared ownership across the vendor lifecycle.

Finding #2. Regulatory Pressure Reshapes the TPRM Landscape

Much like a sudden change in weather patterns disrupts a natural habitat, regulatory scrutiny is altering the TPRM environment. Compliance teams, once peripheral observers, now act as ecosystem regulators, with their presence in TPRM jumping from 42% in 2023 to 88% in 2025.

This growing influence is driving broader accountability and better data stewardship. As organizations respond to evolving regulatory climates surrounding data privacy and operational resilience, they are rebalancing internal responsibilities and expanding their oversight of vendor ecosystems.

Implication: Regulation is no longer background noise — it’s a dominant climate force. Programs must embed compliance into their operational DNA to ensure adaptability and long-term ecosystem health.

Finding #3. Cybersecurity Still Dominates, But Risk Horizons Are Expanding

Just as ecosystems depend on keystone species, cybersecurity remains the most heavily monitored risk (85%). But risk managers are now broadening their surveillance to include data privacy (79%), compliance (70%), and business continuity (64%) — acknowledging the symbiotic and interdependent nature of modern risk.

Departments such as Information Security, Risk Management, and Data Privacy are becoming more engaged stewards within the ecosystem, reflecting a shift toward managing a broader range of threats across the organizational landscape.

Implication: TPRM must evolve to reflect biodiversity in risk, expanding visibility and building stronger interdepartmental cooperation across the enterprise.

Finding #4. Manual Tools Undermine Insight and Incident Readiness

In an ecosystem, inadequate monitoring tools can lead to missing the early signs of imbalance, whether it’s a disease outbreak in a population or a shift in water quality. In TPRM, the same is true. Despite growing complexity, 41% of organizations still rely on spreadsheets to assess third parties. While 60% feel these tools meet basic needs, only 29% can determine risk at every stage of the vendor lifecycle, and just 15% feel prepared to respond to third-party incidents.

This patchwork of tools — often lacking integration — limits visibility, disrupts agility, and prevents proactive management.

Implication: Outdated tools are the equivalent of monitoring a forest with a magnifying glass. To build a resilient and adaptable risk ecosystem, organizations must invest in integrated platforms that enable comprehensive, real-time insights.

Finding #5. AI in TPRM: Cautious Optimism Meets Implementation Hurdles

Artificial intelligence is emerging as a powerful new species within the TPRM ecosystem — one with the potential to automate tasks, accelerate insights, and centralize risk data. Today, 14% of programs actively use AI, and 65% are exploring its capabilities.

Yet caution persists. Concerns around data security, algorithmic opacity, and a lack of human oversight mean many organizations are still testing the waters. Still, the groundwork is being laid: only 12% now cite a lack of AI strategy as a barrier, down from 49% in 2024.

Implication: AI is a promising but sensitive organism in the TPRM habitat. Careful introduction, governance, and monitoring will be critical to realizing its full potential without upsetting the balance.

Looking Ahead: The Rise of Connected Risk Management

The study reveals a sector recognizing the value of an interconnected, symbiotic risk ecosystem. Forward-looking organizations are:

• Breaking down silos through cross-functional governance
• Embedding compliance into risk workflows as a structural safeguard
• Leveraging automation and AI to bolster ecosystem resilience
• Expanding risk oversight to account for a wider range of “environmental” threats

Recommendations for Building a Resilient TPRM Program

To maintain the balance and sustainability of their third-party ecosystems, organizations should consider the following best practices:

1. Establish Cross-Functional Governance

Unify Risk, Compliance, Procurement, and IT Security under a shared framework with clear ownership protocols.

2. Operationalize AI Thoughtfully

Start small with AI — apply it in low-risk areas while establishing policies for transparency, oversight, and security.

3. Automate to Offset Resource Gaps

Identify manual bottlenecks and prioritize automation in assessment, monitoring, and reporting functions.

4. Embed Compliance into Risk Workflows

Integrate regulatory requirements into your due diligence and monitoring processes to stay ahead of audit demands.

5. Adopt Tiered Risk Assessments

Segment vendors by risk level and apply proportionate assessments using both traditional and dynamic intelligence sources.

Next Steps: Nurture your TPRM Ecosystem

Just as biologists understand that ecosystems are fragile and interconnected, risk professionals must realize that resilience doesn’t come from isolated patches of excellence — it comes from connection. Your organization is not a solitary organism — it’s part of something much larger. It’s time to nurture your ecosystem.

Let us help you cultivate a safer, smarter, and more sustainable environment for your extended enterprise.