Forty-eight percent of breaches in 2026 involved a third party, according to Verizon’s Data Breach Investigations Report. A year earlier that number was 30 percent. That’s roughly a 60 percent jump in twelve months, and if your organization’s vendor risk process still lives entirely inside procurement, that trend line isn’t someone else’s problem to solve. It’s yours.
Here’s the pattern, and I’d bet money it isn’t unique to any one company. Procurement runs the RFP, scores vendors on price and feature fit, negotiates commercial terms, and gets a signature-ready contract in front of legal. Somewhere near the end, usually within a couple weeks of the target close date, security and architecture get looped in for “final review.” By then the business sponsor has already told their leadership it’s happening, the contract has been through redlines, and there’s a cancellation clock running on the negotiated pricing. The review that was supposed to catch architectural and security risk gets reduced to a yes/no gate on a decision that was already made.
By the Time We’re Called In, There’s Nothing Left to Shape
That’s the structural failure. When risk and architecture review land at signature instead of intake, the only two outcomes left are approve or block. There’s no room to shape the vendor selection itself, no room to say “we’d take vendor B over vendor A because their identity federation model fits our SSO posture and their data residency terms don’t require an exception.” Those are exactly the questions that should get scored during the RFP, the same way I’ve argued architecture principles need scored implications to mean anything in an RFP. Instead they show up as objections after the deal is basically done. That makes the architecture function look like the department of no, and it makes overriding it feel like the path of least resistance for everyone with a deadline hanging over them.
The questionnaire-driven version of this process isn’t holding up any better, for what it’s worth. Gartner’s 2026 third-party cybersecurity risk predictions found that 62 percent of organizations still lean heavily on due diligence questionnaire answers to drive risk-mitigation decisions, even as those answers are increasingly written by generative AI on the vendor’s side and graded by generative AI on the buyer’s side, according to Gartner’s Predicts 2026 report on third-party risk. Two models generating and grading a self-reported form isn’t due diligence. It’s a compliance artifact. It gives procurement a checkbox and gives the organization almost nothing about how the vendor actually behaves once it’s integrated.
Move the Gate to Intake, Not Signature
The fix isn’t a bigger questionnaire or a longer review meeting bolted onto the end of the process. It’s moving the gate earlier and making it structural instead of optional. Concretely:
- A vendor risk tier gets assigned when the RFP is drafted, based on data sensitivity and integration surface, not after a contract is nearly signed.
- Architecture has a seat in the shortlist conversation, the same way it has a seat in blast-radius decisions at the Architecture Review Board, instead of only showing up at final sign-off.
- Interoperability, identity, and data-handling implications become pass/fail gates or weighted lines in the RFP scoring itself, so a vendor that can’t meet the federation or residency bar never survives the shortlist in the first place.
Not every vendor needs this level of scrutiny, and pretending otherwise is how vendor risk programs collapse under their own weight. A Shared Assessments benchmarking survey found that leading third-party risk programs put roughly 70 percent of their assessment effort against the top 15 percent of vendors by risk exposure, according to a summary from LearnTPRM’s 2026 TPRM guide. That instinct is correct. But tiering has to happen at intake too, because it’s what determines how much architectural scrutiny a given vendor gets before the RFP is even scored, not after.
Where the Record Actually Has to Live
None of this holds up if the output of the review is a PDF that gets emailed to procurement and never opened again. A vendor’s risk tier, its architectural fit, and any exceptions granted against it need to live as attributes on that vendor’s node in your EAM system of record, the same place I track application portfolios, retirement status, and ADRs. I run this through LeanIX specifically, because a vendor risk finding that isn’t tied to the same portfolio view as the rest of the architecture is a finding nobody will find again at renewal time, when the integration surface has grown and the original review is three reorgs old.
Procurement should keep owning commercial terms. Price, SLAs, contract length, none of that belongs to architecture, and I’m not arguing it should. But the judgment about whether a vendor fits the environment, and what it does to the organization’s risk posture, has to be architecture’s call. And that call is worthless if it arrives after the decision is already made. The fix isn’t adding more people to the vendor review meeting. It’s moving the meeting.