Although artificial intelligence (AI) has been around for quite some time, the adoption and evolution of AI-related technologies has dramatically advanced over the last year. One area that seems ready to benefit from AI is third-party risk management — that is, if AI can offer organizations an easier way to manage third-party vendor and supplier risks and ensure compliance with a complex regulatory landscape.
Third parties: Opportunities and challenges
Organizations increasingly rely on third parties to deliver a wide range of goods and services, because it’s far more efficient and cost-effective than producing everything in-house. Unfortunately, this practice also increases vendor and supplier risk. Complex global supply chains make it incredibly difficult to have clear visibility into the security and risk management practices of a growing number of third parties. And how do security professionals mitigate risks they have zero visibility into? It’s a difficult but important task, because cyber criminals are increasingly attacking third parties in the supply chain to steal sensitive data and disrupt operations.
As third-party threats become increasingly sophisticated, it’s taking more time for organizations to find and remediate third-party risk. There are three primary reasons for this shift:
- The volume of cyber data continues to increase, originating from an ever-growing number of sources. The vast quantities of data require more time and effort to analyze and review.
- Analysis processes require diverse documentation types, depending on the department managing the vendor and the risks they want to manage. Risks may be financial, operational, compliance, reputational, or information technology related, which significantly expands the type of documentation – and expertise – needed for analysis.
- Regulatory requirements may overlap or be unclear, but they are also increasingly rigorous, complicating remediation and reporting.
Third-party risk management is now facing a tipping point. As many organizations continue to face budgetary and resourcing challenges, how can security leaders still make much-needed improvements to the efficiency of their third-party risk management (TPRM) programs? Doing so is essential if they want to reduce the risk of breaches, minimize potential business impacts and protect the organization’s reputation.
Can AI streamline third-party risk management processes?
AI may hold the answer. The following are three specific ways AI can improve third-party risk vendor and supplier challenges.
1. Automate the collection and analysis of risk data from a wide range of sources — AI can automate the collection and analysis of data from a wide range of sources, such as financial statements, security logs and security certifications. AI can then predict future risks based on historical data from those artifacts and current trends. This reduces the time and effort required to manage third-party risks and improves the quality of decision making.
2. Provide context to simplify risk analysis and compliance reporting — Complying with a complex array of regulations can be a significant challenge for compliance and audit teams, who often lack clear guidance on how to address risks. Frequently, the processes identified for validating controls are also inconsistent, further complicating the process. But while enormous quantities of data are time consuming (and boring) for humans to analyze and process, properly trained AI systems can automatically analyze vast quantities of risk data to provide context and identify patterns and trends. An AI solution makes it simpler for compliance and audit teams to evaluate risks and controls and generate guidance and remediation recommendations.
3. Automate manual tasks to help risk managers be more proactive — Risk managers traditionally spend a considerable amount of time sifting through spreadsheets, manually entering data and generating reports. This makes it challenging to strategize, analyze emerging risks, and engage in long-term planning. Because AI collects and analyzes historical data and current trends, it can predict future risks, helping security professionals become more proactive because they actually have the time needed to forecast, evaluate and mitigate risks that might threaten the organization’s objectives. The result is faster, more accurate and data-driven decisions regarding risks related to third-party vendors and suppliers.
What to look for in an AI TPRM
It’s become clear over the last year that AI, particularly the large language models (LLMs) that have dominated the news, does not necessarily provide a perfect solution to every problem. Organizations leveraging AI tools must be aware of some of the potential risks and be certain that they are addressed.
- Whether it comes from statistical anomalies, bad input, or ill-suited learning model data, AI can deliver an invalid interpretation as fact (and do it with confidence). This is known as hallucination. To address this risk, AI TPRM solutions must ensure that the data used to train the model is based on real third-party risk data — it must be accurate, diverse, and representative of real-world scenarios. Such solutions must continually fine-tune their models to ensure that they continue to improve by learning context and nuances specific to third-party risk.
- When AI systems are built using biased learning model data, the responses will inevitably be equally biased. Bias can be difficult to detect, therefore it is critical to use training data that is diverse and representative of the real-world population. It’s essential to continuously update and retrain AI models to incorporate new data and mitigate potential bias. Human reviewers are an important way to identify bias in AI-generated content and decisions and assess the performance of the solution, which means solution providers must conduct regular audits of these AI models.
- It’s important to remember that inputting proprietary data into third-party LLMs is not a good idea, because the data can then be shared outside the organization. Similarly, LLM solutions can embed inputs into their data models, which allow subsequent queries to that data, which may be confidential. To prevent unauthorized access, sensitive data must be encrypted both at rest and in transit to protect it from such queries. If using AI to handle certain TPRM tasks, the solution must incorporate strong access controls and authorization mechanisms to prevent unauthorized individuals or systems from accessing and manipulating the data.
Managing third-party vendors and suppliers has always been a challenging aspect of risk management. From due diligence to compliance checks to ongoing monitoring, risk managers are overwhelmed with demands on their time and attention. An appropriately trained and maintained AI solution for TPRM can automate routine tasks and provide advanced analytical tools to enable risk managers to focus on strategic activities that benefit the business as a whole.
