BlueVoyant released its sixth annual State of Supply Chain Defense Report.?The 2025 study highlights a shift in focus: instead of concentrating on enforcement and compliance (the primary concern in 2024), organizations are now focused on the lack of integration of supply chain risk into broader enterprise risk frameworks. The survey also highlights ongoing investment in tools, teams and processes, although gaps between program maturity and organizational commitment still remain.
“As the attack surface expands, an effective third-party risk management program is more important than ever,” said Joel Molinoff, Global Head of Third-Party Risk Management at BlueVoyant. “For six years now, the goal of this report has been to raise awareness and understanding on building a successful third-party risk program. While there are bright spots from this year’s survey, there is still more work to be done to ensure we can start closing this gap between program maturity and organizational commitment.”
This year’s study found an alarming 97% of organizations reported negative impacts from supply chain breaches over the past twelve months, up from 81% in 2024. While there is marked growth in budgets and maturity, organizations are increasingly struggling to combat supply chain threats. Key data points observed in the report include:
- As TPRM programs mature, they’re lacking internal support: While nearly half (46%) of organizations report established and optimized TPRM programs, there is a troubling gap between maturity and organizational support.
- Reducing risk may be taking a back seat to compliance: Only 16% of respondents listed risk reduction as the primary program driver, while cyber insurance requirements, contractual obligations, and board mandates came out on top.
- Gaps in integration lead to silos and inefficiencies: While organizations have made investments into TPRM tools and processes, many have neglected to integrate those into broader enterprise risk frameworks. Sectors like financial services, manufacturing, defense, and retail all listed a lack of integration as a top pain point.
- Vendor ecosystem growth often surpasses program maturity: An overwhelming 96% of organizations plan to grow their third-party ecosystems over the next year, with some sectors like healthcare projecting double digit expansion. Unfortunately, many organizations are adding vendors faster than they’re adding visibility, validation, or remediation capacity.
“Organizations are fully aware of the risks their third-party vendors pose, but they’re less clear on how to tackle the problem because of inconsistent organizational support,” said Brendan Conlon, Global Director of Third-Party Risk Management at BlueVoyant. “Integrated systems and genuine commitment to risk reduction over simply meeting compliance requirements will be the difference in delivering positive security outcomes and drowning in box checking.”
