All Resources

When a new vulnerability or supplier breach hits the headlines, leadership wants answers fast: are we exposed, which suppliers are affected, and what's being done about it. In this Ask Me Anything session, Risk Ledger's CEO Haydn Brooks and COO Emily Hodges tackle audience questions on identifying exposure quickly, prioritising supplier outreach, managing executive expectations, and building response processes that hold up under pressure.

Security leaders from Staffordshire County Council and Xentrall Shared Services ICT joined Risk Ledger to discuss how they scaled supplier assurance, embedded security into procurement, and reduced cyber risk without straining stretched public sector teams.

Point-in-time due diligence is creating a dangerous blind spot for security leaders. Despite strict new regulations, empirical data reveals that dozens of systemically vital UK suppliers actively lack foundational security controls — like MFA and regularly rehearsed disaster recovery plans. Read our executive summary to discover the operational reality of control erosion and learn why transitioning to continuous, Active Supply Chain Security (ASCS) is essential to protecting your organisation from systemic risk.

Traditional third-party risk management is creating a dangerous drag on business velocity. With over a third of UK organisations taking three weeks or more to clear new vendors, security teams are often viewed as commercial bottlenecks. Discover how CISOs can eliminate this friction and accelerate onboarding without sacrificing assurance by transitioning to a network-first Active Supply Chain Security (ASCS) model.

Cyber threats don't stop at your direct suppliers. Catch up on our latest webinar featuring Justin Kuruvilla (Risk Ledger) and Ben Short (Blake Morgan) to learn how law firms are moving beyond traditional third-party risk assessments. Watch the full recording to discover why shared intelligence, improved visibility, and AI governance are the new foundations for collective resilience in the legal sector.

Compare Prevalent alternatives - Panorays, UpGuard, OneTrust, ProcessUnity, SecurityScorecard, RiskRecon and Risk Ledger - on evidence model, supplier participation, monitoring and total cost.

With 82.4% of UK cyber security professionals reporting a third-party breach in the past year, supply chain attacks remain a critical, systemic threat in 2026. This article breaks down the latest data on supply chain dependencies, analyses recent high-profile incidents, and explains why security teams must transition from static annual questionnaires to active, network-level risk management to combat hidden concentration risks.

Compare Risk Ledger against Panorays, UpGuard, SecurityScorecard, BitSight, Prevalent, OneTrust and ProcessUnity on architecture, supplier evidence and monitoring - including where each one is the better fit.

How do you secure a supply chain when vendors are adopting AI at an unprecedented scale? Learn why managing this new era of third-party risk requires assessing your suppliers through two critical lenses: responsible AI usage and defense against AI-accelerated threats.

Two suppliers can each pass assessment individually and still fail together. Here's how shared dependencies create supply chain risk, and what to do once you can see one.

A practical DORA compliance checklist for financial services teams, covering ICT risk, incident reporting, Article 30 contracts, the Register of Information, resilience testing, subcontracting and third-party risk evidence.

Compare Panorays alternatives - UpGuard, SecurityScorecard, BitSight, Prevalent, OneTrust, ProcessUnity and Risk Ledger - on reviewer-sourced strengths, monitoring approach and supplier evidence, with a decision guide for choosing the right fit.

New 2026 survey data on TPRM trends: incident rates, regulation, AI risk and supply chain visibility gaps across 500 UK security leaders.

Watch our AMA webinar with Raj Kohli (DCR Partners) and Ben Gibbons (Orange Cyberdefense) on AI risk, TPRM, quantum, and third-party security in 2026.

A practical vendor risk assessment framework for teams past the questionnaire stage, covering risk tiering, evidence by tier, review workflows, decision templates and reassessment triggers.

Attack Surface Management finds exposed assets. TPRM assesses suppliers' internal controls. Neither catches concentration risk. A 2026 guide.

How to uncover hidden supplier dependencies, concentration risk and visibility gaps - and build a clearer picture of your supply chain exposure.

A vendor security questionnaire guide covering key questions, an adaptable template, how to scope by risk, SIG vs CAIQ, and what a completed questionnaire can't tell you.