AI agents for third-party risk: what an agent assembles, what a human accepts

Third-party involvement in breaches doubled from 15% to 30% in a single year, per Verizon’s 2025 breach report. A supply-chain compromise now runs about $4.91 million and takes 267 days to contain, per IBM’s 2025 figures. The World Economic Forum’s 2026 outlook found 65% of large organizations naming third-party and supply-chain risk their top resilience challenge, up from 54% a year earlier.

The problem is not that firms ignore vendor risk. It is that they assess it once, at onboarding, in a questionnaire, and then not again until next year. Risk does not hold still for a year.

My view: continuous third-party risk management is where an agent earns its keep, and the pattern is the same one that works for KYC and customer onboarding. The agent assembles the case, screens, maps ownership, collects evidence, and watches the feeds. A human accepts the risk, approves the exception, or terminates the relationship. Get that split wrong and you have either a bottleneck no agent relieves or an agent making decisions it cannot defend to a regulator.

Why point-in-time review broke

The classic TPRM workflow is a spreadsheet and a questionnaire. Procurement sends a vendor a 200-question assessment, files the response, assigns a tier, and moves on. A year later it repeats.

That model fails on two fronts at once. It is slow at the front, where onboarding a critical vendor takes weeks of chasing documents and emailing back and forth. And it is blind in the middle, where a vendor’s cyber posture degrades, its parent gets sanctioned, or an adverse-media story breaks the day after you filed the annual review.

Regulation caught up to the gap. DORA, which applies to EU financial entities as of January 17, 2025, requires ongoing monitoring of ICT third parties, not a yearly snapshot. Sanctions regimes expect risk-based screening that keeps current. Continuous monitoring of cyber, financial, sanctions, and adverse-media signals is now the baseline, not the differentiator, and no team staffs enough analysts to do it by hand across hundreds of vendors.

What the agent assembles

The agent’s job is to turn a slow, manual case file into a fast, standing one. Break it into the steps it can own outright.

Intake and evidence collection come first. Given a new vendor, the agent requests the questionnaire, ingests the responses and uploaded documents, and flags what is missing instead of a human noticing three weeks later. The work is retrieval and orchestration, not judgment.

Screening is the highest-value action. The agent runs the vendor and its principals against sanctions lists, watchlists, and adverse-media sources, and returns hits with the source attached. The vendor Diligent, for one, shipped an agentic due-diligence product in March 2026 that automates exactly this: entity resolution, ownership mapping, and risk synthesis, with a citation-backed trail for every finding. The citation is the point. A screening hit an agent cannot source is a finding you cannot act on.

Ownership mapping is where the manual process bleeds the most hours. Untangling a beneficial-ownership structure across shell entities is slow, pattern-heavy work, and it is what pushes onboarding from days into weeks. An agent that resolves entities and maps ownership turns that into minutes and hands the analyst a structure to verify.

Tiering follows from the signals. The agent proposes a criticality tier from the vendor’s data access, spend, and screening results, and drafts the risk memo. It proposes; it does not decide.

Continuous monitoring, not the annual snapshot

The larger win is what happens after onboarding, in the eleven months the old model ignored. A triggered agent watches the risk feeds and acts when a signal crosses a line, the same shape as any monitoring agent that turns a raw event into a drafted response.

A cyber-rating drop, a new sanctions designation, a lawsuit, an adverse-media story: each is an event the agent can catch, match to the affected vendor and the contracts that depend on it, and escalate with context already assembled. The analyst opens a case that says what changed, which vendor, which contracts, and what the agent recommends, instead of finding out from the news.

Alert triage is the part that makes this survivable. Continuous feeds are noisy, and most alerts are not material. The agent’s real value is filtering the 90% that don’t matter and surfacing the few that do, with the evidence attached, so a human is not drowning in low-signal notifications. That triage is judgment the agent is good at and a queue no human can keep up with.

Reassessment scheduling closes the loop. The agent tracks when a tier requires a fresh review, initiates it, and reopens the case, so the program stays current by construction rather than by someone remembering.

The reference architecture on Salesforce

Model the vendor as an Account or a custom object with child records for assessments, findings, and monitoring alerts. Contracts and the business owner are related records. The point is a durable case file, not a document in someone’s inbox.

Unify the vendor view in Data 360 when the same supplier shows up across procurement, security, and finance systems. The agent grounds on that unified record so it reasons over one vendor, not three fragments. Governed access matters here, because a TPRM agent reads sensitive risk data and must only see what its permission set allows.

Reach the external signal providers, sanctions and watchlist data, cyber ratings, adverse-media feeds, through External Services or an MCP server rather than hand-built Apex per source. Each screening provider with an OpenAPI spec becomes an agent action, and a Named Credential handles the auth.

Coordinate the multi-owner steps with Flow Orchestration and keep a human in the loop where it counts. Here is a compact invocable action that scores a vendor’s inherent risk tier from stored signals. It reads the record and returns a tier and whether human review is mandatory. It never clears a vendor on its own.

public class VendorRiskTiering {
    public class Request {
        @InvocableVariable(required=true) public Id vendorId;
    }
    public class Result {
        @InvocableVariable public String tier;        // Critical | High | Medium | Low
        @InvocableVariable public Boolean requiresHumanReview;
    }

    @InvocableMethod(label='Score Vendor Risk Tier'
        description='Derives an inherent-risk tier from stored vendor signals')
    public static List<Result> score(List<Request> requests) {
        List<Result> results = new List<Result>();
        for (Request req : requests) {
            Vendor__c v = [
                SELECT Data_Access_Level__c, Annual_Spend__c,
                       Sanctions_Hit__c, Cyber_Rating__c
                FROM Vendor__c WHERE Id = :req.vendorId LIMIT 1
            ];
            Result r = new Result();
            Boolean highExposure = v.Data_Access_Level__c == 'Sensitive'
                || v.Annual_Spend__c > 1000000
                || v.Cyber_Rating__c < 600;
            r.tier = v.Sanctions_Hit__c ? 'Critical'
                : highExposure ? 'High' : 'Medium';
            // Any sanctions hit or critical tier is never auto-cleared.
            r.requiresHumanReview = v.Sanctions_Hit__c || r.tier == 'Critical' || r.tier == 'High';
            results.add(r);
        }
        return results;
    }
}

The load-bearing rule is in the last line. A sanctions hit or a critical tier always routes to a human. The agent computes and recommends; it never decides the risk is acceptable.

Where the human still decides

Three decisions stay human, and building the stop into the workflow is what keeps the program defensible.

Accepting the risk is the first. Deciding a flagged vendor is acceptable, with or without conditions, is a judgment with the firm’s name on it. The agent lays out the finding, the exposure, and the options. A risk owner signs.

The exception is the second. When a critical vendor fails a control but the business needs it anyway, someone has to own that trade-off and document why. An agent can draft the exception and its compensating controls; a human approves and carries it.

Offboarding is the third. Terminating a vendor over a risk finding has contractual and operational fallout, and it is the kind of irreversible step a human-in-the-loop design exists to gate. The agent can prepare the termination case. A person makes the call.

There is a structural trap worth naming: segregation of duties. If one agent both assesses a vendor and clears it for payment, you have built the control failure TPRM exists to prevent, the same segregation-of-duties problem agents create by construction in procurement. Keep assessment and approval in different hands, agent or human.

The gotchas that decide whether it holds up

Defensibility is the first, and it is non-negotiable in a regulated program. Every finding the agent produces needs a source and an audit trail, because “the model flagged it” is not something you present to a regulator or a board. Ground on cited evidence, log the reasoning, and keep the human decision on the record.

Screening quality is the second. Name matching produces false positives (a common name that isn’t your vendor) and false negatives (a near-miss the match logic drops). The agent’s screening is only as good as the data sources and the match tuning behind it, and a missed sanctions hit is a compliance failure, not a rounding error. Tune conservatively and let a human adjudicate close calls.

Cost at scale is the third. Continuous monitoring across hundreds or thousands of vendors, each generating feed events, multiplies actions fast under per-action Flex Credit billing. Model the consumption before you turn on continuous monitoring for the whole vendor population, and filter aggressively so the agent acts on material signals, not every ripple.

Start where the exposure is highest: your critical and high-tier vendors, continuous monitoring first, onboarding automation second. Prove the agent shortens the case and catches the signal your annual review would have missed, then widen the population. The teams that get this right treat the agent as the analyst that never sleeps and never the officer who signs, because in third-party risk the signature is the whole point.

Understanding the basics

What is an AI agent for third-party risk management?

It is an AI agent that automates the labor-heavy parts of vendor risk: collecting onboarding evidence, screening the vendor and its owners against sanctions and adverse-media sources, mapping beneficial ownership, proposing a risk tier, and monitoring risk feeds continuously after onboarding. It assembles and maintains the vendor case file so analysts focus on the decisions rather than the data-gathering.

Can an AI agent approve or reject a vendor on its own?

No, and it should be built so it cannot. The agent screens, scores, and recommends, but accepting a risk, approving an exception, or terminating a vendor stays a human decision with documented ownership. A sanctions hit or a critical tier should always route to a human, both for defensibility and because segregation of duties requires assessment and approval to sit in different hands.

How does continuous monitoring differ from annual vendor reviews?

Annual reviews assess a vendor once and go blind until the next cycle, which misses cyber-posture drops, new sanctions, and adverse media that occur in between. Continuous monitoring uses a triggered agent to watch risk feeds and escalate material changes as they happen, with the affected contracts and a recommendation already attached. Regulations like DORA now require ongoing monitoring rather than a yearly snapshot.

What Salesforce components fit a TPRM agent?

Model vendors and assessments as records, unify the vendor view in Data 360 with governed access, connect sanctions and cyber-rating providers through External Services or an MCP server, run continuous monitoring with triggered agents, and coordinate onboarding and approvals with Flow Orchestration. Agentforce provides the agent runtime, topics, and actions, with human approval gated at the decision points.

Scoping a third-party risk agent, and drawing the line between the case it assembles and the risk your officers accept? Talk to us. Building agents that speed the analysis without making the decision is exactly the work we do.