{"id":206883,"date":"2026-04-28T19:44:00","date_gmt":"2026-04-28T23:44:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/04\/28\/smart-firms-treat-vendor-risk-like-their-own\/"},"modified":"2026-04-28T19:50:12","modified_gmt":"2026-04-28T23:50:12","slug":"smart-firms-treat-vendor-risk-like-their-own","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/04\/28\/smart-firms-treat-vendor-risk-like-their-own\/","title":{"rendered":"Smart Firms Treat Vendor Risk Like Their Own"},"content":{"rendered":"

Smart Firms Treat Vendor Risk Like Their Own<\/a><\/p>\n

https:\/\/www.pymnts.com\/cybersecurity\/2026\/smart-firms-treat-vendor-risk-like-their-own\/<\/a><\/p>\n

Publish Date: 2026-04-28 19:44:00<\/a><\/p>\n

Source Domain: www.pymnts.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. Artificial intelligence has opened up Pandora\u2019s box for enterprise cybersecurity. And what it found was that the modern enterprise is no longer a closed system. It is a web of dependencies, stitched together by software vendors, cloud providers, and outsourced engineering partners.<\/p>\n

Increasingly, this means the weakest link isn\u2019t one that\u2019s found inside the organization at all but instead resides across the long tail of third-party software that keeps operations running. That may be old news to some in the C-suite, but what\u2019s new news is how fast latent vulnerabilities across a corporate supply chain can be surfaced, thanks in large part to emerging frontier AI models, like both Anthropic\u2019s Mythos and OpenAI\u2019s GPT 5.4 cyber model, and their user-agnostic capabilities for cyber exploitation.
\nIn response to today\u2019s dynamic and evolving threat landscape, Microsoft\u00a0recently (April 14) patched over 167 existing security vulnerabilities in its\u00a0Windows\u00a0operating systems and related software with new updates.
\nVulnerabilities that might once have lingered undetected for months are now surfaced in days, sometimes hours. In parallel, attackers are becoming more opportunistic, scanning not just primary targets but their extended ecosystems for entry points.
\nBut in a world of interconnected systems, patch discipline is only as strong as the weakest vendor.
\nSee also: What AI-Driven Attack Chains Mean for CFOs and CISOs\u00a0Advertisement: Scroll to Continue <\/p>\n

Race to Protect Soft Spots AI Unearths
\nCybersecurity has always been described as a moving target. What distinguishes the current moment is how quickly yesterday\u2019s best practices are becoming today\u2019s minimum requirements. Patch discipline, vendor audits, and incident response planning are no longer differentiators; they are table stakes.
\nPYMNTS covered Monday (April 27) how hackers have reportedly begun impersonating\u00a0Microsoft Teams\u00a0help desk workers to dupe victims into installing data-stealing malware. These attacks are part of a larger trend PYMNTS covered last week, one that sees\u00a0hackers\u00a0\u201clogging in\u201d\u00a0rather than breaking in.
\nThe result is a paradox: even as internal defenses improve, overall risk can increase because the attack surface has expanded beyond direct control. A vendor\u2019s delayed patch cycle or misconfigured system can become the enterprise\u2019s problem overnight.
\nFor CFOs, this introduces a category of risk that is both material and difficult to quantify. Unlike traditional operational risks, third-party vulnerabilities are often opaque, buried in contractual relationships that may have been primarily negotiated for cost efficiency or speed rather than cyber resilience.
\nThe\u00a0PYMNTS Intelligence\u00a0report \u201cVendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms\u201d found that hackers are increasingly\u00a0going after\u00a0middle market firms, which\u00a0depend\u00a0on third-party cloud providers, software-as-a-service platforms, managed service and logistics providers, which can leave them vulnerable to attack.
\nAs a result, the predictable rhythms of enterprise IT maintenance are increasingly misaligned with the pace of modern threats. Vulnerabilities disclosed today can be weaponized tomorrow. If a vendor takes weeks to deploy a fix, that lag becomes a window of exposure not just for them, but for every client connected to their systems.
\nSee also: FBI Warns: Internal Risk May Outpace Cyber Threats\u00a0
\nNew Cybersecurity Table Stakes
\nThird-party risk is no longer a niche compliance concern. It is becoming the frontline of defense.
\nAs cybersecurity becomes more intertwined with enterprise value, the CFO\u2019s role is expanding. This does not mean becoming a technical expert. It does mean asking sharper questions. How quickly do our critical vendors patch known vulnerabilities? What visibility do we have into their security practices? How are we prioritizing investments in vendor risk management relative to other initiatives?
\nData, in this environment, is becoming critical to powering real-time visibility. CFOs can embrace strategies such as automated scanning, continuous monitoring, and predictive analytics to provide a more dynamic view of a partner\u2019s security posture.
\n\u201cThe lagging organizations treat the data as a storage problem while the leading organizations actually treat it as a decisioning system,\u201d Max Spivakovsky, senior director of global payments risk management at\u00a0Galileo,\u00a0told PYMNTS in an interview posted this month for the \u201cWhat\u2019s Next in Payments\u201d series.
\nSee also:\u00a0Cybersecurity\u2019s Hottest New Job Is Negotiating With Hackers
\nBut perhaps the most profound shift is a conceptual one. Third-party risk management is moving from a periodic, compliance-driven exercise to a continuous process. Annual audits and questionnaires are no longer sufficient in a landscape where vulnerabilities can emerge and evolve rapidly.
\nAfter all, AI isn\u2019t the only vulnerability high-value enterprise firms and institutions are facing. In other cybersecurity news, PYMNTS wrote earlier about the way\u00a0Quantum Day\u00a0\u2014 the moment when commercially available quantum computers can crack widely used cryptographic systems \u2014 has ceased being a distant hypothetical.
\n\u201cAs a result of the shrinking strategic horizon, what was once a theoretical, deep-tech risk is instead now being operationalized into present-day procurement decisions, product roadmaps and compliance mandates,\u201d that report said.<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Smart Firms Treat Vendor Risk Like Their Own https:\/\/www.pymnts.com\/cybersecurity\/2026\/smart-firms-treat-vendor-risk-like-their-own\/ Publish Date: 2026-04-28 19:44:00 Source Domain:…<\/p>\n","protected":false},"author":1,"featured_media":206884,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.pymnts.com\/wp-content\/uploads\/2026\/04\/third-party-cyber-risk1.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,20,24,32,27],"class_list":["post-206883","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-artificial-intelligence","tag-cybersecurity","tag-malware","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206883"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=206883"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206883\/revisions"}],"predecessor-version":[{"id":206885,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/206883\/revisions\/206885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/206884"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=206883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=206883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=206883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}