In my latest report Cyber Risk Ratings Is Transforming Into Third-Party Cyber Risk Intelligence (for Forrester clients only), I outline multiple dynamics highlighting the limitations of cyber risk ratings (CRR) and why change is needed.  CISOs are weary with CRR’s tendency to provide due diligence data over action, their inability to trust the data itself, and the concern that AI will bring more noise and findings.  This concern is evidenced by CRR platforms exhausting their growth story, experiencing a plateau in adoption.

This blog explains why we at Forrester are making the change from Cyber Risk Ratings to Third Party Cyber Risk Intelligence; defines Third-Party Cyber Risk Intelligence; and outlines what CISOs need to do in the next 3 years to deliver value to their third party risk programs (TPRM).

Cybersecurity Risk Ratings Won The Market But Lost The Mission

Our Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026, and the CRR Buyers Guide found that the scorecard driven approach to third-party cyber risk created by cybersecurity risk ratings resulted in trade-offs that become hard to ignore, and expressed the need for solutions that:

  • Better identify critical process and technical third-party security weaknesses. CISOs need solutions that help them use scarce time and resource on the issues that present the highest level of risk. With AI further accelerating the level of vulnerabilities being found in third-party ecosystems since Frontier AI models transformed traditional vulnerability management, this has taken on increased importance.
  • Significantly improve their ability to sift out noisy findings, with limited risk. This allows better prioritization of findings surfaced from third-party risk assessments. Threat intelligence and adoption of modern vulnerability prioritization techniques are also critical to provide better context and targeted focus on areas where active exploitations are being observed by threat actors targeting specific industries.
  • Integrate TPRM and remediation capabilities for their cyber programs. These capabilities combine these different data inputs to ensure these critical risks get fixed. As existing ratings solutions struggled with much of this, customer adoption has plateaued, leaving limited room for further market expansion in its current form.

Over The Next Three Years, Cyber Risk Ratings Must Moves From Findings To Risk Reduction

To meet their aspirations above, security and risk leaders have to reject the status quo of their CRR programs, and make data and intelligence-driven risk reduction the goal, while preparing for CRR platforms to fade, and they embrace Third-Party Cyber Risk Intelligence.

At Forrester, we define Third-Party Cyber Risk Intelligence as:

The integration of third-party cybersecurity risk management practices, questionnaires, and control assessments with operational context and threat intelligence to help S&R teams identify exploitable, actively targeted third-party risks and prioritize remediation based on operational reality, rather than theoretical control or framework gaps.

Ratings providers will augment existing data with stronger threat intelligence and support the full cyber TPRM lifecycle, including corrective action planning and remediation management—capabilities most CRR platforms currently lack.

As this market evolves, CISOs should pay attention to the following shifts:

  • Threat Intelligence becomes a key differentiator in validating and prioritizing third party risk. CISOs need to better use threat intelligence to help prioritize which findings or issues matter most, and represent the highest levels of risk to an organization and its third-party ecosystem. Seeing which vulnerabilities are being exploited in the wild, targeting organizations like their suppliers, CISOs (especially those with complex and extensive supply chains) can focus remediation more effectively, something today’s solutions have struggled to provide. To do this, providers will either acquire, or develop their threat intelligence capabilities over the next 2 years, and provide better capabilities enabling CISOs to make effective use of threat intelligence in their TPRM programs.
  • Pricing model transformation allows more third-party ecosystem monitoring. CISOs find point-in-time assessments ineffective for their TPRM programs, whether informed by a rating or not. They need to implement continuous monitoring of observable data across their entire third-party ecosystem in addition to questionnaires. More importantly, they need an economical way to expand continuous monitoring to their entire third-party ecosystem. Providers will respond by moving beyond existing consumption-based pricing models which have traditionally limited client adoption of continuous monitoring of suppliers. New, and more predictable and flexible fixed cost pricing structures will emerge in the next 12 months, allowing organizations to expand their coverage.
  • AI takes a greater role in third party assessment, allowing teams to focus on risk prioritization. CISOs need their TPRM teams to determine which risks they need to prioritize within their third-party ecosystems. Today’s teams spend their time aggregating information from disparate ratings and questionnaire platforms manually. AI capabilities in this market will increase substantially, allowing automation of much of today’s assessment burden, across both questionnaire returns, operational data, and generation of recommended remediation and prioritization actions. This shift will both increase the quality, and the capacity of existing cyber TPRM teams, allowing them to drive remediation action with third-party stakeholders, within the next three years.

Today’s CRR platforms will evolve to support integrated cyber TPRM workflows. These improvements will shift professionals’ focus from assessment to corrective action management. Security leaders will spend less time on assessment and more time driving down third-party security risks. Combining questionnaires and other vendor provided due diligence with technical operational data will also create opportunities to unite traditionally separate SOC and TPRM teams. Teams will be able to work from a shared understanding of third-party security risks and become more effective in driving targeted remediation of critical third-party security issues.

Forrester customers can access my report on this market evolution here and can book a guidance session or inquiry call to discuss this further with me.

Share