Security operationsAnalysis
Third parties were in 48% of breaches; 1 of 5 TPRM pricing pages shows a price
Three Verizon DBIR editions, IBM's 2025 India breach cost, five vendors' pricing pages and the RBI's 2023 outsourcing direction, read together as of September 2026.
The 2022 version of this piece said third-party risk management was “a must” and quoted a Gartner figure we can no longer find. Four years on, the question an Indian CISO or procurement head actually asks is narrower: how much of my breach risk sits with suppliers, what does it cost to watch them, and which regulator will ask me to prove I did? The answers, as of September 2026, are: about half, from nothing to $35 a vendor a month before the platforms start quoting, and the RBI, in writing, with clause numbers.
01Third-party involvement tripled across three DBIR editions
Verizon introduced an expanded third-party measure in its 2024 Data Breach Investigations Report, counting a breach as third-party involved when partner infrastructure was affected or when a direct or indirect software-supply-chain issue, including a vulnerability in third-party software, was in the chain. On that measure the share ran 15% in the 2024 edition, doubled to 30% in 2025 and reached 48% in the 2026 edition, which covers incidents from November 2024 to October 2025.1 2
The share of breaches involving a third party went from 15% to 48% in two years
Breaches with third-party involvement on Verizon's expanded measure, by DBIR edition, 2024 to 2026
15%
2024 edition
30%
2025 edition
48%
2026 edition
Incidents from November 2024 to October 2025
Source: Verizon DBIR 2024, 2025 and 2026 editions, as tracked by Security Scientist; 2026 edition covers Nov 2024 to Oct 2025 incidents · as of 30 September 2026 · Each edition's figure is the share of that year's analysed breaches; the Verizon reports themselves were not re-read for this piece
The mechanism is economic. A ransomware crew that compromises one file-transfer product, one identity provider or one managed-service provider gets hundreds of victims for one exploit. Attackers moved to suppliers because the return on a supplier is higher, and the 2026 edition’s other headline, that exploited vulnerabilities overtook stolen credentials as the leading way in, is the same story told from the other side: the flaw is usually in software somebody else wrote.2
02In India a breach costs ₹22 crore, and 17% start at a vendor
IBM’s Cost of a Data Breach study, released in India on 7 August 2025, put the average total cost of a breach for an Indian organisation at ₹22 crore, an all-time high and about 13% above the ₹19.5 crore of 2024. The breach lifecycle, from first access to containment, fell to 263 days, 15 days faster than the year before. Research organisations (₹28.9 crore), transportation (₹28.8 crore) and industrial firms (₹26.4 crore) paid most. Among initial vectors, IBM lists “third party vendor and supply chain compromise” at 17% of the Indian breaches studied.3
An Indian breach averaged ₹22 crore in 2025; one in six began with a vendor or supplier
IBM Cost of a Data Breach Report 2025, India figures, against IBM's 2024 India average
₹22 cr
Average total cost of a data breach in India, 2025
IBM, 7 August 2025
+13%
Rise from the ₹19.5 crore average of 2024
IBM, 7 August 2025
17%
Indian breaches whose initial vector was a third-party vendor or supply-chain compromise
IBM, 7 August 2025
263 days
Average time to identify and contain, 15 days faster than 2024
IBM, 7 August 2025
Source: IBM India newsroom, 7 August 2025 · as of 7 August 2025 · IBM's figures are a sample of studied organisations, not a census; the 2024 comparison is IBM's own
Put the two studies together carefully. Verizon’s 48% is involvement anywhere in the chain; IBM’s 17% is the initial vector only, and for India only. They are not the same measure and should not be averaged. What they agree on is the shape of the risk: a meaningful share of what will cost you ₹22 crore begins on a system you do not run, and the 263 days it takes to identify and contain a breach are days your supplier’s logs, not yours, would have shortened.
03Ratings look from outside; questionnaires ask inside; one of two prints a price
The 2022 piece treated security ratings and questionnaires as one product. They are two instruments with different blind spots. A security rating is outside-in: the vendor scans a supplier’s public footprint, open ports, certificate hygiene, leaked credentials, patch cadence on internet-facing software, and scores it continuously without the supplier’s cooperation. A questionnaire is inside-out: the supplier answers how it handles your data, who has access and what its incident process is, and a reviewer judges the answer. The first cannot see an internal access-control failure; the second cannot verify a claim.
A rating sees the supplier's outside; a questionnaire records what the supplier says about its inside
What each third-party risk instrument can and cannot observe, TechBag reading of vendor documentation, September 2026
Security rating (outside-in)
- Continuous, no supplier cooperation needed; scores every domain you list
- Sees exposed services, certificate and DNS hygiene, leaked credentials, patch lag on public software
- Blind to internal access control, data handling and sub-processors
- Published price exists: UpGuard Standard $1,750 a month for 50 vendors; SecurityScorecard free for your own domain, paid tiers quoted
Assessment platform (inside-out)
- Inventory, tiering, questionnaire workflow and an audit record with owners and dates
- Captures data flows, access, sub-processors and incident process as the supplier states them
- Blind to anything the supplier does not say; a reviewer still has to judge the answer
- No published price among the three TechBag resells: OneTrust, Optro and MetricStream are all quote-only
Source: UpGuard and SecurityScorecard product and pricing pages; TechBag OneTrust Third-Party Management intel page · as of 30 September 2026
On price, the market is lopsided. UpGuard publishes one tier: Vendor Risk Standard at $1,750 a month, billed annually, for 50 monitored vendors, with extra vendors at $79 a month each; Professional (150 vendors), Corporate (500) and Enterprise+ are quote-only, and the page itself says it was last updated in September 2026.4 SecurityScorecard gives any organisation a free scorecard for its own domain, with no limit on users, and prices every paid tier by “the number of organizations you’d like to monitor” through a sales conversation.5 OneTrust Third-Party Management, a Leader in Gartner’s 2026 Magic Quadrant for Third-Party Risk Management Tools, publishes no price; nor do Optro, also a Leader on that quadrant, or MetricStream.6 7
04For an Indian bank or NBFC this has been a duty since 1 October 2023
The regulation the 2022 piece reached for was American: FISMA, SOX, GLBA. The one that applies here is the Reserve Bank of India’s Master Direction on Outsourcing of Information Technology Services, issued 10 April 2023 and in force from 1 October 2023. It does not ask whether you have a tool. It asks for a sequence of evidence: due diligence before onboarding and on an ongoing basis (clause 13), a risk-based evaluation covering financial soundness, security controls and the provider’s ability to segregate your data (clause 14), contractual audit and access rights for you and for the RBI, including over sub-contractors (clause 16), a management structure that monitors performance, with cyber incidents relayed fast enough for you to report to the RBI within six hours (clauses 17 and 19), an assessment of concentration risk where several outsourcings land on one provider (clause 17), and a documented exit strategy (clause 22).8
The RBI's 2023 outsourcing direction is a four-stage evidence trail, not a tool mandate
Duties of a regulated entity under the RBI (Outsourcing of IT Services) Directions, 2023, by stage of the supplier relationship
- 01
Assess
Due diligence before signing and on an ongoing basis; financial, operational, legal, security and data-segregation factors; concentration risk across providers (clauses 13, 14, 17).
- 02
Contract
Audit and access rights for the regulated entity and its auditors; the RBI’s right to inspect the provider and its sub-contractors; termination and transfer rights (clause 16).
- 03
Monitor
A management structure for performance, uptime and SLA adherence; periodic review of the provider’s condition; incidents relayed so the RBI is told within six hours (clauses 17, 19).
- 04
Exit
A clear exit strategy with continuity during transition, alternative arrangements, and safe removal or destruction of data on termination (clauses 18, 22).
Source: RBI Master Direction RBI/2023-24/102, text of the direction · as of in force 1 October 2023
Read against the two instruments in the previous section, the direction maps cleanly. The rating is the cheapest way to meet “ongoing basis” across the whole supplier list; the assessment platform is where clauses 13, 14 and 22 become dated records an inspector can query. Neither is named in the text, and a bank that keeps the evidence in a disciplined spreadsheet is compliant. The tools buy the discipline, not the compliance.
Sources
- Verizon, 2026 Data Breach Investigations Report, landing page (collection window 1 November 2024 to 31 October 2025) — undated page
- Security Scientist, Third-party and supply-chain breaches: the fastest-growing risk (DBIR expanded measure 15%, 30%, 48%) — undated page Secondary summary; the DBIR editions themselves were not re-read.
- IBM India newsroom, India Records Highest Average Cost of a Data Breach (INR 220 million; 17% third-party vendor and supply-chain compromise) — 7 August 2025
- UpGuard, pricing (Vendor Risk Standard $1,750/month for 50 vendors; $79 per extra vendor; higher tiers quote-only) — page states last updated September 2026
- SecurityScorecard, pricing (free scorecard for your own domain; paid tiers by number of organisations monitored, quote-only) — undated page
- TechBag, OneTrust Third-Party Management intel page (Gartner 2026 TPRM Magic Quadrant Leader; quote-only) — vendor documentation as of mid-2026
- TechBag, Optro hub (Leader, 2026 Gartner TPRM Magic Quadrant; quote-only) and MetricStream hub (third-party risk line; quote-only) — vendor documentation as of mid-2026
- Reserve Bank of India, Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102) — 10 April 2023; in force 1 October 2023
- RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026 (RBI/DoS/2026-27/410), via practitioner summary — 31 July 2026 RBI PDF not fetched.
- SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 — 20 August 2024; in force 31 August 2025 Not re-fetched for this piece.
- DPDP Rules 2025, commencement timeline — notified 13 November 2025
- Digital Personal Data Protection Act, 2023, section 8(1) (the data fiduciary remains responsible for processing by its processor) — 11 August 2023
Related on TechBag: the OneTrust Third-Party Management page sets the inventory, tiering and audit-record model against RBI and IRDAI duties; the Optro IT and Cyber Risk page covers the other 2026 Leader; the security guides hold the vulnerability and exposure tools a rating vendor is scoring your suppliers on.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
