--- title: "Third parties were in 48% of breaches; 1 of 5 TPRM pricing pages shows a price" summary: "Three Verizon DBIR editions, IBM's 2025 India breach cost, five vendors' pricing pages and the RBI's 2023 outsourcing direction, read together as of September 2026." url: https://www.thetechbag.com/blog/third-party-risk-management-security-ratings-must format: Analysis desk: "Security operations" published: 2024-12-24 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["third-party risk","TPRM","security ratings","UpGuard","SecurityScorecard","OneTrust","Optro","MetricStream","DBIR","RBI","SEBI CSCRF","DPDP"] cover: https://www.thetechbag.com/blog/covers/third-party-risk-management-security-ratings-must.png --- # Third parties were in 48% of breaches; 1 of 5 TPRM pricing pages shows a price *Three Verizon DBIR editions, IBM's 2025 India breach cost, five vendors' pricing pages and the RBI's 2023 outsourcing direction, read together as of September 2026.* Analysis · Security operations · By TechBag · Published 2024-12-24 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/third-party-risk-management-security-ratings-must The short version - Verizon’s DBIR put third-party involvement at **15%** of breaches in its 2024 edition, 30% in 2025 and 48% in 2026. The definition is broad, but the direction is not in doubt.[1] [2] - In India a breach cost ₹22 crore on average in 2025, up 13% in a year, and IBM lists vendor and supply-chain compromise as the initial vector in 17% of the Indian breaches it studied.[3] - Of the two security-ratings vendors whose pricing pages we read, one prints a price: $1,750 a month for 50 vendors. The three assessment platforms TechBag quotes print none. For an Indian bank or NBFC the programme has been an RBI obligation since 1 October 2023.[4] [5] [8] The 2022 version of this piece said third-party risk management was “a must” and quoted a Gartner figure we can no longer find. Four years on, the question an Indian CISO or procurement head actually asks is narrower: how much of my breach risk sits with suppliers, what does it cost to watch them, and which regulator will ask me to prove I did? The answers, as of September 2026, are: about half, from nothing to $35 a vendor a month before the platforms start quoting, and the RBI, in writing, with clause numbers. ## Third-party involvement tripled across three DBIR editions Verizon introduced an expanded third-party measure in its 2024 Data Breach Investigations Report, counting a breach as third-party involved when partner infrastructure was affected or when a direct or indirect software-supply-chain issue, including a vulnerability in third-party software, was in the chain. On that measure the share ran 15% in the 2024 edition, doubled to 30% in 2025 and reached 48% in the 2026 edition, which covers incidents from November 2024 to October 2025.[1] [2] ReportedWhat the 48% counts The measure is deliberately wide. A breach that began with an exploited flaw in a vendor’s appliance counts, as does a breach of a SaaS provider that held your data. It is not a count of “vendors who leaked our data”; it is a count of breaches in which someone other than the victim wrote or ran part of the stack that failed. That is the right denominator for a buyer, because it is the part of the estate you do not patch yourself.[2] **Figure: The share of breaches involving a third party went from 15% to 48% in two years** *Breaches with third-party involvement on Verizon's expanded measure, by DBIR edition, 2024 to 2026* 15% 2024 edition 30% 2025 edition 48% 2026 edition Incidents from November 2024 to October 2025 Source: Verizon DBIR 2024, 2025 and 2026 editions, as tracked by Security Scientist; 2026 edition covers Nov 2024 to Oct 2025 incidents · as of 30 September 2026 · Each edition's figure is the share of that year's analysed breaches; the Verizon reports themselves were not re-read for this piece The mechanism is economic. A ransomware crew that compromises one file-transfer product, one identity provider or one managed-service provider gets hundreds of victims for one exploit. Attackers moved to suppliers because the return on a supplier is higher, and the 2026 edition’s other headline, that exploited vulnerabilities overtook stolen credentials as the leading way in, is the same story told from the other side: the flaw is usually in software somebody else wrote.[2] ## In India a breach costs ₹22 crore, and 17% start at a vendor IBM’s Cost of a Data Breach study, released in India on 7 August 2025, put the average total cost of a breach for an Indian organisation at ₹22 crore, an all-time high and about 13% above the ₹19.5 crore of 2024. The breach lifecycle, from first access to containment, fell to 263 days, 15 days faster than the year before. Research organisations (₹28.9 crore), transportation (₹28.8 crore) and industrial firms (₹26.4 crore) paid most. Among initial vectors, IBM lists “third party vendor and supply chain compromise” at 17% of the Indian breaches studied.[3] **Figure: An Indian breach averaged ₹22 crore in 2025; one in six began with a vendor or supplier** *IBM Cost of a Data Breach Report 2025, India figures, against IBM's 2024 India average* ₹22 cr Average total cost of a data breach in India, 2025 IBM, 7 August 2025 +13% Rise from the ₹19.5 crore average of 2024 IBM, 7 August 2025 17% Indian breaches whose initial vector was a third-party vendor or supply-chain compromise IBM, 7 August 2025 263 days Average time to identify and contain, 15 days faster than 2024 IBM, 7 August 2025 Source: IBM India newsroom, 7 August 2025 · as of 7 August 2025 · IBM's figures are a sample of studied organisations, not a census; the 2024 comparison is IBM's own Put the two studies together carefully. Verizon’s 48% is involvement anywhere in the chain; IBM’s 17% is the initial vector only, and for India only. They are not the same measure and should not be averaged. What they agree on is the shape of the risk: a meaningful share of what will cost you ₹22 crore begins on a system you do not run, and the 263 days it takes to identify and contain a breach are days your supplier’s logs, not yours, would have shortened. ## Ratings look from outside; questionnaires ask inside; one of two prints a price The 2022 piece treated security ratings and questionnaires as one product. They are two instruments with different blind spots. A security rating is outside-in: the vendor scans a supplier’s public footprint, open ports, certificate hygiene, leaked credentials, patch cadence on internet-facing software, and scores it continuously without the supplier’s cooperation. A questionnaire is inside-out: the supplier answers how it handles your data, who has access and what its incident process is, and a reviewer judges the answer. The first cannot see an internal access-control failure; the second cannot verify a claim. **Figure: A rating sees the supplier's outside; a questionnaire records what the supplier says about its inside** *What each third-party risk instrument can and cannot observe, TechBag reading of vendor documentation, September 2026* Security rating (outside-in) - Continuous, no supplier cooperation needed; scores every domain you list - Sees exposed services, certificate and DNS hygiene, leaked credentials, patch lag on public software - Blind to internal access control, data handling and sub-processors - Published price exists: UpGuard Standard $1,750 a month for 50 vendors; SecurityScorecard free for your own domain, paid tiers quoted Assessment platform (inside-out) - Inventory, tiering, questionnaire workflow and an audit record with owners and dates - Captures data flows, access, sub-processors and incident process as the supplier states them - Blind to anything the supplier does not say; a reviewer still has to judge the answer - No published price among the three TechBag resells: OneTrust, Optro and MetricStream are all quote-only Source: UpGuard and SecurityScorecard product and pricing pages; TechBag OneTrust Third-Party Management intel page · as of 30 September 2026 On price, the market is lopsided. UpGuard publishes one tier: Vendor Risk Standard at $1,750 a month, billed annually, for 50 monitored vendors, with extra vendors at $79 a month each; Professional (150 vendors), Corporate (500) and Enterprise+ are quote-only, and the page itself says it was last updated in September 2026.[4] SecurityScorecard gives any organisation a free scorecard for its own domain, with no limit on users, and prices every paid tier by “the number of organizations you’d like to monitor” through a sales conversation.[5] OneTrust Third-Party Management, a Leader in Gartner’s 2026 Magic Quadrant for Third-Party Risk Management Tools, publishes no price; nor do Optro, also a Leader on that quadrant, or MetricStream.[6] [7] TechBag countTechBag count Five pricing pages read in September 2026: UpGuard, SecurityScorecard, OneTrust, Optro, MetricStream. One prints a figure a buyer can multiply. At UpGuard’s published tier the arithmetic is $35 a vendor a month for the first 50 and $79 a vendor a month after that. BitSight’s pricing page refused our request, so it is not counted either way.[4] Our view Our view: buy the rating for breadth and the assessment platform for depth, and in that order. A mid-sized Indian company with 200 suppliers can rate all of them for less than the cost of one analyst, then spend the questionnaire effort on the twenty that hold customer data. A platform without the rating produces a well-documented set of unverified claims; a rating without the platform produces a dashboard nobody is accountable for. ## For an Indian bank or NBFC this has been a duty since 1 October 2023 The regulation the 2022 piece reached for was American: FISMA, SOX, GLBA. The one that applies here is the Reserve Bank of India’s Master Direction on Outsourcing of Information Technology Services, issued 10 April 2023 and in force from 1 October 2023. It does not ask whether you have a tool. It asks for a sequence of evidence: due diligence before onboarding and on an ongoing basis (clause 13), a risk-based evaluation covering financial soundness, security controls and the provider’s ability to segregate your data (clause 14), contractual audit and access rights for you and for the RBI, including over sub-contractors (clause 16), a management structure that monitors performance, with cyber incidents relayed fast enough for you to report to the RBI within six hours (clauses 17 and 19), an assessment of concentration risk where several outsourcings land on one provider (clause 17), and a documented exit strategy (clause 22).[8] **Figure: The RBI's 2023 outsourcing direction is a four-stage evidence trail, not a tool mandate** *Duties of a regulated entity under the RBI (Outsourcing of IT Services) Directions, 2023, by stage of the supplier relationship* 1. 01AssessDue diligence before signing and on an ongoing basis; financial, operational, legal, security and data-segregation factors; concentration risk across providers (clauses 13, 14, 17). 2. 02ContractAudit and access rights for the regulated entity and its auditors; the RBI’s right to inspect the provider and its sub-contractors; termination and transfer rights (clause 16). 3. 03MonitorA management structure for performance, uptime and SLA adherence; periodic review of the provider’s condition; incidents relayed so the RBI is told within six hours (clauses 17, 19). 4. 04ExitA clear exit strategy with continuity during transition, alternative arrangements, and safe removal or destruction of data on termination (clauses 18, 22). Source: RBI Master Direction RBI/2023-24/102, text of the direction · as of in force 1 October 2023 Read against the two instruments in the previous section, the direction maps cleanly. The rating is the cheapest way to meet “ongoing basis” across the whole supplier list; the assessment platform is where clauses 13, 14 and 22 become dated records an inspector can query. Neither is named in the text, and a bank that keeps the evidence in a disciplined spreadsheet is compliant. The tools buy the discipline, not the compliance. If you are buying this in India Three regimes now overlap. The RBI’s 2023 outsourcing direction above applies to banks, NBFCs and the other entities it lists, and the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026 add, for commercial banks, vendor contracts with audit and RBI inspection rights and a six-hour DAKSH report.[9] SEBI’s Cybersecurity and Cyber Resilience Framework, circulated 20 August 2024 and in force for regulated entities since 31 August 2025, carries its own third-party and vendor-risk controls.[10] And the Digital Personal Data Protection Act, 2023 keeps the data fiduciary, not its processor, responsible for a processor’s failure (section 8(1)), with the Rules notified on 13 November 2025 and the security and breach-notification duties in force from 13 May 2027.[12] [11] On cost: every price here is a USD list price; an Indian reseller adds 18% GST on the invoice, and OneTrust, Optro and MetricStream are quoted in INR with GST through TechBag. We quote those three and carry no ratings vendor, which is a reason to read section 3 twice. How we did this Figures as of 30 September 2026 The DBIR percentages are the three editions’ expanded third-party measure as tracked by Security Scientist and summarised in the 2026 edition’s trade coverage; the Verizon reports were not re-read for this piece, and the 2026 edition’s own landing page gives the collection window but not the third-party figure. The India cost figures are IBM’s 7 August 2025 release, verbatim. Pricing is read from the UpGuard and SecurityScorecard pages in September 2026; the OneTrust, Optro and MetricStream positions are from TechBag’s own intel pages, built from vendor documentation in mid-2026. BitSight’s pricing page returned an access error and is excluded. The RBI clauses are read from the Master Direction text; the SEBI CSCRF circular was not re-fetched. Nothing here was verified with any supplier or regulator. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Verizon, 2026 Data Breach Investigations Report, landing page (collection window 1 November 2024 to 31 October 2025)](https://www.verizon.com/business/resources/reports/dbir/) — undated page 2. [Security Scientist, Third-party and supply-chain breaches: the fastest-growing risk (DBIR expanded measure 15%, 30%, 48%)](https://www.securityscientist.net/blog/dbir-third-party-supply-chain/) — undated page Secondary summary; the DBIR editions themselves were not re-read. 3. [IBM India newsroom, India Records Highest Average Cost of a Data Breach (INR 220 million; 17% third-party vendor and supply-chain compromise)](https://in.newsroom.ibm.com/2025-08-07-India-Records-Highest-Average-Cost-of-a-Data-Breach-IBM) — 7 August 2025 4. [UpGuard, pricing (Vendor Risk Standard $1,750/month for 50 vendors; $79 per extra vendor; higher tiers quote-only)](https://www.upguard.com/pricing) — page states last updated September 2026 5. [SecurityScorecard, pricing (free scorecard for your own domain; paid tiers by number of organisations monitored, quote-only)](https://securityscorecard.com/pricing/) — undated page 6. [TechBag, OneTrust Third-Party Management intel page (Gartner 2026 TPRM Magic Quadrant Leader; quote-only)](https://www.thetechbag.com/onetrust/onetrust-third-party-management) — vendor documentation as of mid-2026 7. [TechBag, Optro hub (Leader, 2026 Gartner TPRM Magic Quadrant; quote-only) and MetricStream hub (third-party risk line; quote-only)](https://www.thetechbag.com/optro) — vendor documentation as of mid-2026 8. [Reserve Bank of India, Master Direction on Outsourcing of Information Technology Services (RBI/2023-24/102)](https://www.rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12486) — 10 April 2023; in force 1 October 2023 9. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026 (RBI/DoS/2026-27/410), via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. 10. [SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113](https://www.sebi.gov.in/legal/circulars/aug-2024/cybersecurity-and-cyber-resilience-framework-cscrf-for-sebi-regulated-entities-res-_85964.html) — 20 August 2024; in force 31 August 2025 Not re-fetched for this piece. 11. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 12. [Digital Personal Data Protection Act, 2023, section 8(1) (the data fiduciary remains responsible for processing by its processor)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 Related on TechBag: the [OneTrust Third-Party Management](https://www.thetechbag.com/onetrust/onetrust-third-party-management) page sets the inventory, tiering and audit-record model against RBI and IRDAI duties; the [Optro IT and Cyber Risk](https://www.thetechbag.com/optro/optro-it-cyber-risk) page covers the other 2026 Leader; the [security guides](https://www.thetechbag.com/browse/security) hold the vulnerability and exposure tools a rating vendor is scoring your suppliers on. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Security guides](https://www.thetechbag.com/browse/security) — the vulnerability and exposure tools a ratings vendor scores your suppliers on - [OneTrust Third-Party Management](https://www.thetechbag.com/onetrust/onetrust-third-party-management) — inventory, tiering and the audit record, a 2026 Gartner TPRM Leader - [Optro hub (formerly AuditBoard)](https://www.thetechbag.com/optro) — the other 2026 TPRM Leader this piece names, quote-only