When a team is drowning in work, one obvious fix is hiring more people. It's the lever every leader has considered pulling first for the last decade, especially with third-party risk programs. So here's the surprising thing about where security teams have landed now: adding headcount isn’t always the first or most desirable move.
In our new survey of 309 IT and security leaders and practitioners, 78% said insufficient people or tool capabilities are limiting how many third parties they can assess and how thoroughly they can assess them. Insufficient staffing was the single most-cited obstacle, named by 59%. And yet, asked about their top priorities for the year ahead, only 11% listed adding headcount.
That gap is deliberate. Teams have decided more of the same won't close it, so they're betting on a different model.
It’s the Rate (Not Volume)
The reason hiring feels right is that the problem feels like a volume problem, and volume problems seem to yield to more hands. The trouble is that third-party risk behaves like a rate problem, and the rate is accelerating. Enough hands can clear a fixed pile of work; they can't outrun a growing one.
Over the past 24 months, 71% of respondents reported that the number of third parties organizations they work with increased, and the number they're trying to assess rose for 74%. Team size grew for 69% of respondents as well too — but not at the same pace. Only about one in ten saw a significant increase in headcount, while roughly three times as many saw significant growth in the number of vendors they needed to assess.
When the workload grows faster than the team, and each assessment still takes the same fixed number of analyst hours, hiring only slows the rate at which the gap grows. You would have to keep hiring, every year, forever, faster than your vendor portfolio grows — and no security budget works that way.
What Teams Are Choosing Instead
Look at where programs actually plan to invest and a clear pattern emerges. The top priorities for the year are automating the collection of third-party risk data (48%), strengthening AI-governance assessment (47%), automating the analysis of that data (44%), and continuous monitoring (42%). Every one of these is a technology bet. Adding staff sits at the bottom of the list.
The logic is straightforward. Hiring adds capacity in proportion to headcount — one more analyst, a few dozen more thorough assessments a year. Automation changes the proportion itself. When the collection and analysis that consume most of an analyst's hours are handled by the system, the same team can cover more vendors, more deeply, more often, without a linear increase in people. Capacity starts to scale with the portfolio instead of the org chart.
Practitioners Are Making the Ask
It's important to be clear about who is driving this. The push to modernize third-party risk is coming from operational resilience (69%) and regulatory requirements (53%) — the people who own the work and answer to the regulators — far more than from the boardroom, where board pressure ranks near the bottom of the drivers at 6%. Operators are making this call: people who have run the manual playbook, seen where it caps out, and concluded that the next unit of progress has to come from a better model.
People still matter. Skilled analysts are what make a program defensible, and their time is the scarcest resource in the building. Spending it on collecting documents and chasing questionnaires is the opposite of leverage. The teams pulling ahead are redirecting that time toward judgment and letting automation carry the volume. The report lays out the capacity gap in detail and what a program that scales without linear hiring actually looks like.
See the findings in The State of Third-Party Risk Management 2026, or book a demo to see how Drata's approach helps lean teams achieve depth at scale.