Third parties now involved in almost half of breaches, yet fewer than a quarter of large UK business

LONDON - Sept. 28, 2026 - PRLog -- The organisations that keep the UK running, from energy and water to healthcare, transport and telecoms, increasingly depend on suppliers whose cyber risk they cannot fully see. RiskXchange describes this widening gap between reliance and visibility as the "Blind Spot Economy".

The consequences are already visible. In June 2024, a ransomware attack on Synnovis, a pathology provider to NHS trusts in south-east London, led to more than 10,000 outpatient appointments and around 1,700 elective procedures being postponed. The hospitals were not the entry point; their supplier was.

According to Verizon's 2026 Data Breach Investigations Report, 48% of breaches in its dataset involved a third party, up from 30% the previous year.

In the UK, the visibility gap is stark. The UK Government's Cyber Security Breaches Survey 2025/2026 found that only 15% of businesses formally review cyber security risks posed by their immediate suppliers, and just 6% review risks across their wider supply chain. Among large businesses, 48% review immediate suppliers and only 24% their wider supply chain.

Regulatory expectations are rising too. The Cyber Security and Resilience (Network and Information Systems) Bill will update the UK's rules for protecting essential services, bring managed service providers into scope and give regulators powers relating to critical suppliers.

"Businesses have spent years strengthening the security of their own environments, but increasingly, that is only part of the picture," says Darren Craig, Founder and CEO of RiskXchange. "Every supplier, software provider and contractor an organisation depends on can introduce another layer of risk."

"We call this the Blind Spot Economy: the growing gap between the third parties organisations depend on and what they can actually see happening across that ecosystem."

WHY POINT-IN-TIME ASSURANCE LEAVES GAPS

Traditional third-party risk management has relied on questionnaires, periodic assessments and manual review. These provide useful assurance at a single point in time, but supplier risk does not stand still between assessments.

New vulnerabilities emerge. Security postures change. Suppliers connect to other suppliers. Credentials are compromised. For Critical National Infrastructure, each change can become a blind spot.

RiskXchange believes organisations need to move beyond asking "Have we assessed our suppliers?" towards "Do we know where our third-party risk is changing right now?"

"The threat landscape isn't waiting for the next annual assessment. The way organisations understand third-party risk shouldn't either," Craig says.

For more information http://www.riskxchange.co