Nine Exploited Vulnerabilities in Five Days: What ProcessUnity CVE Monitoring Found Across Third-Party Portfolios
Between Monday, October 26 and Friday, October 30, 2026 the Cybersecurity and Infrastructure Security Agency (CISA) added nine vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. These aren’t theoretical flaws. CISA only adds a vulnerability to the KEV catalog once there’s reliable evidence attackers are already using it, and six of this week’s nine came […]
Inside ProcessUnity Risk Index: What Makes Up the Rating and How to Use It
ProcessUnity research conducted by our data science team recently found that third parties with weak ProcessUnity Risk Index scores are 47 times more likely to experience a breach. That finding raises a fair follow-up question for any risk team: What exactly goes into a ProcessUnity Risk Index score, and how much weight should you put […]
Vendor Risk Analysis: How to Prioritize High-Risk Vendors (Without the Guesswork)
In our inherent risk series, we’ve explored what an inherent risk rating is and how to build an effective vendor risk tiering model. But once that baseline is established, a new question emerges: Which high-risk vendors require attention first? It’s a pressing question. ProcessUnity’s State of Third-Party Risk Assessments 2026 report found that organizations assess […]
What is ProcessUnity Risk Index? A Plain-Language Guide to the New Era of Vendor Risk Ratings
Third-Party Risk Management (TPRM) teams have never had more trouble collecting information about their vendors. On the surface, everything seems fine: Vendors return questionnaires and share evidence. The problem isn’t a shortage of raw material, it’s the time spent interpreting the data and applying it within your program. Scale this problem against hundreds of new […]
How One TPRM Programme Can Satisfy SS2/21, PS26/2, DORA and the EBA Guidelines
When the UK’s financial regulators finalised their new third-party reporting rules, they did something regulators rarely do: they told firms, explicitly, that the requirements were designed to line up. The PRA and FCA published aligned rules on the same day, with shared templates and a single submission system for dual-regulated firms. The incident report matches […]
The PRA and FCA Rewrote the Third-Party Rules. Here’s What Changes Before March 2027.
When the Prudential Regulation Authority published PS7/26, most third-party risk teams filed it under “reporting requirements” and moved on. That was a mistake twice over. First, because the updated SS2/21 buried in its appendices changes what regulators expect firms to know about every material third party they rely on. And second, because the PRA didn’t […]