A full year of vendor incidents — what they cost, who they reached, and how to price your own exposure the next time one lands.
Registers get filed. Ratings get bought. Questionnaires get answered. None of that is an awareness problem — it is a timing problem. Almost every control in a standard program operates before the incident or after the dust settles.
The decision that determines the cost happens in between, on the morning a vendor discloses and nobody can yet say whether you are in scope. That window is what this report is about.
Nearly half of breaches now involve a third party — a share that has tripled in three years.
How long vendors take to find a compromise, how much longer they take to say so, and what runs in the gap. Contractual notification turns out to be the slowest input a program has.
What happens when everyone’s critical vendors are the same handful of vendors — including the part regulators have started naming out loud, and what that means for a mid-market register.
The model providers you procured, the ones already inside vendors you did procure, and the failure mode showing up first. It is not the one most questionnaires ask about.
Vendor incidents have a calendar, and a cap table. Two variables almost no program models, and one of them changes who answers your incident call.
Our own method for the question a board asks after a disclosure: are we exposed, what is it worth, and does staying with this vendor still make sense. Published with the report.
A small number of 2026 vendor incidents worked end to end — exposure, options, and what each option would have cost a mid-market company.
One email when Issue 02 publishes in April 2027.
You’re on the list. One email — when Issue 02 publishes in April 2027.
Every figure in the report will carry its publisher, date and link — including where the sources disagree with each other.
Cyber risk in mergers, acquisitions and private equity. Buyers agree security posture moves price — and most still cannot say by how much.