AI in Risk Management: Focusing on Third-Party Risk

According to SkyQuest Global research, only 39% of organizations today are using artificial intelligence for risk management. However, another 24% plan to use it in the next two years. Using artificial intelligence (AI) to automate traditionally manual tasks of auditing reports, due diligence, vendor risk assessments and security questionnaires offers organiszations a wide range of advantages that include the reduction of operational costs, the ability to process data and react to threats more quickly and more accurately with fewer false positives and greater visibility throughout the supply chain.

Since many third-party risk management processes also traditionally rely on manual tasks, they often consume precious time and resources, making them inefficient. However, as the cybersecurity landscape becomes more complex and organizations have been forced to manage hundreds and thousands of threats at any one time, they have started to increasingly rely on automated processes facilitated by AI for third-party risk management.

A 4-Step Process to Incorporate AI into Third-Party Risk Management

When secure, AI tools can dramatically improve an organization’s third-party risk management. Risk managers using AI for TPRM, however, should follow a process to ensure it effectively manages supply chain risks, detects threats, meets compliance and delivers actionable insights – and has the ability to achieve this at scale.

The process includes:

1. Identifying risk. These risks could be operational, security, reputational, financial or regulatory, and different risks could apply to each internal and third-party AI tool.
2. Assess AI-application controls. Internal and third-party AI applications should be continually assessed to evaluate their effectiveness and whether or not they meet compliance with your organization’s regulatory and policy requirements.
3. Determining which data should be collected. You’ll need to understand which data both your internal and third-party AI applications collect and from what sources.
4. Continuous monitoring. AI should continue to detect new vulnerabilities and breaches in the digital supply chain, prioritizing them based on their risk exposure and criticality scores.

The Main Uses for AI in Third-Party Risk Management

Adopting AI for third-party risk management enables organizations to respond more quickly to the increased demand to implement new technology and manage the risk that they present. This risk is increasing as organizations continue to rely on third-party AI tools. According to research from MIT Sloan Management and BCG, while 78% of companies rely on third-party AI tools, 55% of AI failures come from these same tools.

The main uses for AI in TPRM include:

1. Threat intelligence

Since AI models have the capability of analyzing massive amounts of data, they can identify evolving breaches, understand the context of the breach or incident based on data gathered from third, fourth and n-th parties and alert risk managers and security teams in your organization to any relevant risks. This needs to be a continuous process with the goal of developing insights for mitigating against similar threats in the future.

2. Strengthening of the supply chain and third-party resilience

According to McKinsey, only 50% of organizations have visibility into their tier one suppliers, and only 2% of companies have visibility beyond their second tier. It’s these third, fourth and n-th party threats that need to be identified early to prevent significant damage not only to your organization but across the supply chain. After using AI to map the digital supply chain, the CEVs, KEVs and breaches and their impact beyond the first tier, risk managers and security teams can communicate and collaborate with the relevant parties to properly mitigate and remediate against threats, ensuring compliance. At the same time, they’ll also be preparing a knowledge base for how to respond to similar types of threats in the future.

3. Improve accuracy in vendor assessments

Since it has the ability to quickly analyze massive amounts of data, third-party AI tools can run assessments at scale and provide more accurate coverage than traditional assessments, which are typically manual processes that drain an organization’s time and resources. When it comes to governance, AI can also help you increase accuracy and reduce time to validation by accelerating the questionnaire response process. Rather than relying on your suppliers to answer security questionnaires, for example, AI-powered third-party risk management assists in completing these questionnaires based on information, correlating these answers from valid and relevant vendor documents with external validation.

Automating Third-party Risk Management Workflows with AI

Specifically, there are a number of manual workflows in third-party risk management that can be automated using AI tools. AI helps to simplify the effort needed to adhere to policy and regulations so that your organization can scale those efforts effectively.

These AI-powered workflows include:

• Due Diligence. AI can help detect any suspicious customer behavior in third parties resulting from fraud, financial misdemeanors or recent scandals, or verify them against various sanction lists or compliance regulations.
• Auditing reports. AI monitors regulatory compliance or control requirements and detects if your third parties are meeting these requirements (or adapting to any changes in them), helping to reduce incidents of non-compliance.
• Vendor risk assessments. AI collects data, implements predictive modeling, extracts valuable information from documents and evaluates risk based on dynamic data. For example, it uses AI to assess how both internal and third-party controls currently meet your organization’s regulatory and policy requirements.
• Security questionnaires. AI can assist in automating and simplifying the completion of security questionnaires. At the same time, it can improve the accuracy and relevancy of answers to each question. This includes the ability to validate automated responses against critical documents and cyber posture tests on the evaluator’s end while also completing questionnaires automatically on the supplier’s end using relevant vendor documents as references.

The Disadvantages of AI in Third-Party Risk Management

Although AI has many benefits for identifying risks, it poses risks as well, many of which are yet unfamiliar due to the recent emergence of the technology. Almost immediately after the first excitement of the abilities of ChatGPT, for example, organizations also realized its potential for launching phishing scams at scale, writing malicious code, and the ability to be hacked. All of these scenarios pose risks to an organization’s data privacy, security, reputation, ability to meet compliance and even maintain a competitive edge. When third parties use AI, however, these risks are increased due to the sheer volume of data shared.

Specific risks AI poses to third-parties include:

• Lack of transparency. Many different commercial AI tools exist in software, hardware, and third-party services and most are black boxes with regards to the methodology behind the AI model. Without understanding the method for the model, their accuracy can be questioned, affecting the risk assessments, security questionnaires or other workflows developed based on these models. As a result, new regulations will mandate organizations to explain how their commercial AI models work and how they meet data privacy regulations.
• It can pose a supply chain risk. Many different commercial AI tools exist in software, hardware, and third-party services. The lack of centralization makes it difficult to track, along with the different compliance, privacy, legal, reputational and security risks that each pose to an organization. Forrester predicts that in 2024, at least three data breaches will be a result of AI-generated code.
• AI models can become easily distorted. AI models are only as good as their data. Small sample sizes, biased data and model collapse can cause them to become wildly inaccurate. Black swan events such as the global pandemic also impact machine learning models, although some researchers are discovering that AI can help them predict these historically unpredictable events with greater accuracy.
• Data privacy and control. Training an AI model using sensitive vendor documents presents a risk of third-party data leakage. Organizations need to be assured that these documents are stored in a secured environment according to privacy requirements. In addition, “hallucinations” can cause incorrect answers and significantly impact user trust.

How Panorays Helps You Manage Third Party Risk

With AI, you can scale your third-party risk management efforts and work with third parties securely and respond to cyber threats as promptly as necessary.

Panorays’ AI-powered third-party risk management includes four separate pillars:

• Digital supply chain risk management. Develop an inventory of all third, fourth and nth parties, including shadow IT and the technologies that they use. Then track CVEs, KVEs and breaches and map them to relevant third and fourth party suppliers, prioritizing threats according to criticality and their business impact.
• Threat detection. With extended attack surface management based on AI models trained on a large data set of hundreds of millions of continually assessed assets with continual feedback loops from suppliers, you’ll receive an accurate cyber rating of your external suppliers’ attack surface at any point. Asset discovery is continuous to ensure accuracy and reduce both the number of false positives and false negatives in threat detection.
• Governance. Responsible AI assists in preparing guidelines for governance and parameters for third-party evaluation, automating the process of assessing whether a third party meets the compliance and requirements. This is assisted through our AI-powered smart match feature which completes questionnaires faster by basing answers on information found in vendor-approved and publicly available documents while at the same time reducing reliance on internal stakeholders and accelerating the entire third-party risk management process.
• Continuous monitoring. Based on your mapping of your digital supply chain, your organization discovers which third parties need a remediation plan and how they can achieve it together with a list of prioritized tasks.

Want to learn more about how you can manage third-party risk across your entire digital supply chain? Sign up for a free demo today.

FAQs