In today’s digital economy, businesses rely heavily on third-party vendors for various functions, including cloud storage, payment processing, and IT support. While these partnerships enhance efficiency, they also introduce significant cybersecurity risks. A breach at a vendor’s end can create vulnerabilities that affect not just one company but an entire supply chain. As cybercriminals exploit these connections, organizations must take a proactive approach to mitigate third-party cybersecurity risks.
The Growing Threat of Third-Party Cybersecurity Breaches
The recently published Kordia NZ Business Cyber Report 2025 highlights that third-party vendor risks remain a top concern for businesses in New Zealand, with 22% of breaches originating from third-party attacks or breaches. As businesses expand their digital footprint, the attack surface increases, making them more susceptible to sophisticated cyber threats. The report further reveals that 59% of New Zealand businesses experienced a cyber incident in the past 12 months, emphasizing the pressing need for stronger security governance when dealing with external partners.
One of the primary concerns with third-party breaches is that organizations often lack visibility into their vendors’ cybersecurity posture. Many vendors have access to sensitive company data but may not implement stringent security measures. This creates a vulnerability where cybercriminals can infiltrate a trusted vendor and use it as an entry point to larger organizations. The report underscores that managing third-party risk is one of the top challenges businesses face, particularly as cloud and SaaS adoption continues to rise.
Real-World Examples of Third-Party Cyber Breaches
The history of cybersecurity breaches is filled with instances where a vendor’s security lapse had devastating consequences. The Target data breach in 2013 remains one of the most infamous examples, where hackers gained access to Target’s network through a compromised HVAC vendor, leading to the theft of 40 million customer credit card records. More recently, the SolarWinds supply chain attack in 2020 demonstrated how sophisticated cybercriminals could embed malware in software updates, compromising multiple government agencies and Fortune 500 companies.
In this context, the recent Kordia report notes that cyber-attacks in New Zealand increased by 44% in 2024, and cybercriminals are now leveraging AI-powered attacks to scale their operations. The increasing complexity of attacks highlights the need for businesses to not only strengthen their internal security but also demand higher security standards from third-party vendors.
The Financial and Operational Impact of Third-Party Breaches
The financial toll of a third-party cybersecurity breach can be catastrophic. The International Monetary Fund estimates that cybercrime will cost the global economy $23 trillion by 2027, a 175% increase from 2022. The Kordia report also reveals that 16% of New Zealand businesses reported the theft of personal information during a cyber incident, a clear indication of the growing risk posed by inadequate vendor security.
The impact extends beyond financial losses; businesses also suffer reputational damage, regulatory fines, and operational disruptions. The report notes that 1 in 6 businesses affected by a cyber breach paid a ransom demand, indicating the increasing use of double extortion ransomware, where attackers not only encrypt data but also threaten to release it publicly.
Mitigating Third-Party Cybersecurity Risks
Given the escalating threat landscape, organizations must adopt a risk-based approach to managing third-party cybersecurity. The Kordia report recommends that businesses treat identity security as a foundational element in their cybersecurity strategy. This means enforcing strong authentication mechanisms, conducting regular vendor security assessments, and implementing continuous monitoring of vendor activities.
Regular Security Audits and Assessments
Businesses must conduct thorough security assessments before engaging a vendor. The Kordia report found that 36% of businesses had not conducted penetration testing in the past year, exposing them to unknown vulnerabilities. By requiring vendors to adhere to industry security standards such as ISO 27001 or SOC 2 compliance, businesses can ensure a baseline level of security.
Implementing Strict Access Controls
The principle of least privilege access should be applied to third-party vendors, ensuring they only have access to the specific data and systems required for their function. Multi-factor authentication (MFA) should be mandatory, as Adversary-in-the-Middle (AITM) phishing attacks increased by 146% last year, with attackers bypassing MFA using stolen authentication tokens.
Continuous Monitoring and Incident Response Planning
Organizations should implement Security Information and Event Management (SIEM) tools to monitor vendor access and detect anomalies in real time. The Kordia report found that 1 in 4 businesses in New Zealand do not monitor or log activity in their network, making it difficult to detect breaches early. Businesses must also ensure that their incident response plans include third-party breach scenarios, as only 86% of businesses surveyed had an incident response plan, and less than half had tested it.
Cybersecurity Insurance and Regulatory Compliance
As regulatory scrutiny increases globally, businesses must ensure vendors comply with data protection regulations such as GDPR, HIPAA, and New Zealand’s Privacy Act. Additionally, cyber insurance can help mitigate financial risks associated with vendor breaches, providing coverage for data recovery, legal fees, and potential fines.
The Future of Third-Party Cybersecurity: AI, Automation, and Regulation
The integration of AI into cybersecurity presents both opportunities and risks. AI-driven security tools can help detect threats faster, but cybercriminals are also leveraging AI to automate phishing attacks and create highly sophisticated malware. The Kordia report warns that AI-based cyber-attacks will become more adaptive, making it harder for traditional security measures to detect them.
On the regulatory front, countries are strengthening cybersecurity laws to address third-party risks. Australia, for example, has introduced mandatory reporting on ransom payments and new cybersecurity standards for Internet of Things (IoT) devices. Other countries are strengthening regulations on cybersecurity, following NIST , COBIT or other recommended best practices.
Conclusion
Third-party vendor cybersecurity risks are no longer hypothetical—they are an urgent reality for businesses worldwide. Organizations must adopt a multi-layered security approach to protect themselves. By conducting thorough vendor assessments, enforcing access controls, monitoring activity, and preparing for incident response, businesses can significantly reduce their exposure to third-party cyber threats.
As the cyber threat landscape continues to evolve, companies must remain vigilant and proactive, recognizing that security is only as strong as its weakest link. The cost of inaction is simply too high, both financially and reputationally.
References
Kordia New Zealand. New Zealand Business Cyber Security Report 2025. Auckland, NZ: Kordia NZ, 2025.
Appendix: Glossary of Key Terms
Adversary-in-the-Middle (AITM) Attack – A cyber attack where hackers intercept and manipulate communications between two parties, often used to bypass multi-factor authentication.
Least Privilege Access – A security concept that limits access rights for users to only what is necessary to perform their job functions.
Multi-Factor Authentication (MFA) – A security process that requires users to verify their identity using multiple authentication factors, such as passwords and biometrics.
Phishing – A fraudulent attempt to obtain sensitive information, such as usernames and passwords, by pretending to be a trustworthy entity in emails or messages.
Security Information and Event Management (SIEM) – A system that collects and analyzes security data from multiple sources to detect and respond to threats.
Zero Trust Security – A cybersecurity framework that assumes no entity, inside or outside an organization, can be trusted by default and requires continuous verification.
Leave a Reply