TPRM Community Summit 2026 Recap: What Third-Party Cyber Risk Leaders Are Prioritizing Now

Introduction

Lowe's and Black Kite brought third-party cyber risk leaders together in Charlotte, N.C., for the TPRM Community Summit 2026. It was a jam packed day of keynotes, research briefings and candid practitioner panels on what's working in third-party cyber risk management (TPCRM) and what isn't.

The speakers came from different industries and held different titles. They still kept landing in the same places. Here are the five themes that ran through the day.

1. Continuous visibility is becoming the baseline

Point-in-time assessments still have a job. They just can't carry the whole program anymore.

Risk changes every day, and an annual review only captures a single point in time snapshot. The programs that are successful at identifying, managing, and treating third party risk have shifted to ongoing, outside-in monitoring that is supplemented by assessments as needed, due to changes in the risk, technical, or business environments. These programs see third party risk as one of a set of risks that must be continuously monitored. 

That only works with two things in place. The first is a complete inventory of the relationships that touch your data or your network, whatever your contracts call it. The second is a plan for what happens when something changes. Continuous vendor risk monitoring gives you the visibility; the inventory and the plan make it useful.

2. Prioritization is the new bottleneck

There are more vulnerabilities than any team can chase, and the gap is widening.

All of 2025 produced more than 48,000 published CVEs, and as of 25 October, that number has exploded to over 88,000 CVEs so far in 2026. Based on this trend, we can expect to see more than 100,000 CVEs in 2026 (which is the number I predicted when the frontier cybersecurity models were released). No organization can patch their way through that volume, and they shouldn't even try, and nobody can patch a vendor's systems at all. This is the vulnerability deluge in action, and it makes prioritization imperative. Our 2026 Supply Chain Vulnerability Report found that of the 48,000 2025 CVEs, only 58 of them posed a genuine threat to enterprise supply chains. 

So the conversation kept coming back to a smaller set of questions that tell you where to act first: 

• Which vendors actually run the exposed technology? 
• What data do they hold? 
• Are the vendors deemed operational critical?
• Is the flaw being exploited?

Even federal guidance is moving in that direction: CISA's Binding Operational Directive 26-04 shifts agencies from severity-first patching to a risk-based model.

3. Context turns findings into decisions

Heat maps are losing their grip on the boardroom. A financial figure helps, as long as it comes with context.

Here's how I put it on stage. When it comes to real estate, there are three things you care about: location, location, location. In TPCRM, it's context, context, context. The same finding can be urgent at one vendor and background noise at another, and context is what tells you which is which.

Context comes from several places at once:

• Business criticality. Which vendors support the processes your business can't run without, and what happens if one of them goes down?
• Access. What data and systems can each vendor reach, and how sensitive are they?
• Exposure and threat activity. Is the vendor exposed right now, and are attackers actively going after what it runs?
• Concentration. How many of your vendors depend on the same provider, platform or model, so one failure hits many at once?
• Your own risk appetite. How much risk is the business willing to carry to get what it wants from the relationship?

Cyber risk quantification is one of the most useful pieces of that picture, because it translates the rest into terms executives already use. Expressed in honest, explainable, and defensible ranges rather than false precision, a financial figure lets risk teams stop being the department of "no" and start helping the business decide how much risk a project is worth. The common objection is that it takes too long or needs perfect data. It doesn't.

4. Third-party AI risk is outpacing disclosure

AI came up in nearly every session. While nobody was panicking, nobody was relaxed.

Vendors are adding AI features faster than customers are being told about them. Our 2026 Third-Party Breach Report found it takes an average of 117 days to learn about a vendor breach. A new AI capability can show up with far less notice than that. Add the growing number of vendors that rely on the same handful of foundation models, and concentration risk takes on a new shape.

Attackers are moving faster too. Our 2026 Ransomware Report counted 7,551 victims and 61 new ransomware groups, more than one a week. The consensus was that established risk practices still apply to AI; they just have to run faster. The free BK-GA3™ framework, an open standard for assessing third-party AI risk built from more than 50 international frameworks, is a good place to start.

5. Resilience depends on partnership

When a vendor fails, your customers still hold your brand accountable.

That makes third-party resilience a shared effort, inside and outside your walls. Procurement, legal, business continuity and security all need a voice when a relationship starts, not just when it breaks.

The same goes for vendors. Teams that send their suppliers specific, useful intelligence get faster answers than teams that send another long questionnaire. And the relationships that matter most during an incident are the ones built before it. That's what good vendor engagement should look like.

Where to start

The best advice of the day was also the simplest: start small and keep moving.

• Know your inventory. Every relationship with access to your data or your network is in scope.
• Add ongoing monitoring to your assessments. Begin with your most critical vendors and expand from there.
• Prioritize by real-world exposure. Ask whether a vulnerability is exploited and whether your vendors are exposed, not just how severe it is.
• Put risk in dollars. Pick one finding on your risk register and quantify it this quarter.
• Ask your vendors about AI. Find out what they've added this year and what it touches.
• Build relationships now. Know who to call at your critical vendors before the next big disclosure.

Most of us got into this work to reduce risk, not to manage paperwork. The Summit showed that this community is ready to make that shift together. Thanks to Lowe's for co-hosting, and to every speaker, panelist and attendee who made it a real conversation.

Want to see what continuous TPCRM looks like in practice? Book a demo and see every supplier, every risk.