Most security leaders can say that they have a third-party risk management program. Fewer can say that their program actually covers all their third parties. The gap between those two statements is where a lot of risk is hiding.
Our recent survey of 309 IT and security leaders and practitioners maps that gap and where it opens in regard to breadth, depth, and cadence. Each factor is a reasonable compromise on its own. Taken together, they add up to a program that looks complete on paper but leaves real exposure unmeasured.
Breadth: Most Vendors Are Never Fully Assessed
Start with coverage. Only 13% of organizations assess all of their third parties. The other 87% assess fewer vendors than they work with — which means, by definition, that some share of every one of those portfolios goes through the door without a risk review.
Every unassessed vendor is unmeasured exposure — the risk is still there, just uncounted. A supplier you never evaluated can still hold your data, sit inside a critical workflow, or route to a fourth party you've never heard of. "We didn't assess it" means something very different from "it's low risk." In a stretched program, the two quietly collapse into one. That unmeasured risk is also accumulating each year they can’t cover the full portfolio.
Depth: The Assessments That Happen Are Shallow
Now look inside the vendors that do get reviewed. Among those, 93% receive a less-than-thorough assessment across the board. For most programs, that means confirming a vendor holds a current SOC 2 attestation or ISO certificate and moving on — a check that the vendor has a program, not an evaluation of the vendor against your own risk criteria.
A certificate is a useful signal, though a limited one. It doesn't tell you how a vendor handles the specific data you're entrusting to them, whether their controls map to the requirements you actually care about, or what changed since the audit period closed. Depth is the difference between "they're certified" and "we understand what they do with our exposure" — and most assessments stop at the first.
Cadence: Things Get Stale
Finally, timing. Most programs reassess their critical vendors once a year at most — that describes 76% of respondents. An annual review might hold up if vendor risk holds still. It moves constantly. A vendor can turn on an agentic AI workflow, migrate a data store, get acquired, or absorb a breach of their own in a single afternoon, months before the next scheduled review comes due.
A point-in-time assessment is only as good as the day it was taken. Stretch the interval to a year and you're making decisions on evidence that may be eleven months out of date for the vendors you consider most critical.
The Underlying Cause
These three gaps share one root cause. They're symptoms of a single constraint. A full assessment of a critical third party typically takes three to four weeks, and Drata's own data puts each one at roughly 16 hours of an analyst's hands-on labor. At that rate, a single analyst can complete fewer than 100 thorough assessments in a year.
An enterprise with a few hundred critical vendors — sitting inside a total portfolio that often runs into the thousands — would need several full-time analysts doing nothing else just to keep pace. No program has that slack. So something has to give, and what gives is coverage, depth, and freshness, in whatever combination keeps the queue moving. No one chooses wide but shallow on purpose. It's what a fixed-hour manual process produces when the portfolio outgrows the team.
Closing All Three Gaps at Once
The trap is treating these as three separate projects — a coverage initiative, a depth initiative, a cadence initiative — competing for the same scarce analyst hours. Fund one and you starve the others. The only way out is to change what an assessment costs. When collection and analysis are automated and every vendor is evaluated against consistent, criteria-based standards, breadth and depth stop trading off against each other, and keeping evidence current stops being a scheduling problem. Programs can assess more vendors, more thoroughly, more often — because the per-vendor cost that forced the compromise is no longer fixed.
The report itself breaks down the coverage, depth, and cadence data and what depth at scale actually requires.
Read The State of Third-Party Risk Management 2026, or book a demo to see how Drata helps you cover every vendor without proportional headcount.