Third-party cyber risk is a visibility problem first

Ask a supplier-risk team what a critical supplier declared at its last review, and the answer is on file. Ask which software that supplier ships, which cloud platform it runs on and who operates its service desk, and the answer is often an estimate. Third-party cyber risk sits in the distance between declared controls and actual dependencies.

The bar is rising

Questionnaires, audits and certificates are not wrong. Their limit is structural: they describe a moment and a scope, not what you depend on today. Meanwhile NIS2, DORA and the Cyber Resilience Act are moving supervision from periodic documentation towards evidence that is current, and they place the responsibility for supply-chain security with the management body. None of them prescribes a tool. Together, they make a supplier file that was complete at the last review harder to defend.

What we looked into

Together with Antwerp Management School and prof. dr. Yuri Bobbert, we studied whether AI can help organisations see their supply chain as it is, rather than as it was declared: the automated discovery and correlation of supplier assets and risk signals.¹ We reviewed the literature and brought together a panel of fourteen cybersecurity and governance practitioners from the Netherlands and Belgium.

Two findings set the direction. The panel gave priority to signals that can be observed from the outside and refreshed continuously, over anything a supplier declares about itself. And it was clear about the limits: such signals work as explainable decision support for the people who already decide on onboarding, renewal and escalation, never as a score that replaces their judgement. Which signals came out on top, how far apart the panel was on each, and what it takes to put them to work in a regulated organisation is what we would rather discuss in person.

Three questions for the board

Before any tool is considered, three questions show whether the visibility is there:

1. Which single suppliers could halt a critical function? Not the vendor list, but a short list of names, each with the function that depends on it.
2. How current is our evidence about them? The date of the last questionnaire is not the same as what can be observed today.
3. Who owns the escalation? When a signal changes, who assesses it, who decides, and within what time?

If these answers take more than one meeting to assemble, the visibility problem is already on the agenda. We are glad to walk through the findings with you and what they mean for your supply chain; the decisions remain with the board.

Sources

1. Research by A. Sewnandan and M. El Jerrari with Antwerp Management School, together with prof. dr. Yuri Bobbert. A paper derived from it, ChainShield: AI-Driven Enumeration for Supply Chain Cyber Risk Governance, was presented at IEEE ICAISF 2026 in Catania. ↩︎