In my latest report, Cybersecurity Risk Ratings Is Transforming Into Third-Party Cyber Risk Intelligence (for Forrester clients only), I outline multiple dynamics highlighting the limitations of cyber risk ratings (CRRs) and why change is needed. CISOs are weary with CRR’s tendency to provide due-diligence data over action, their inability to trust the data itself, and the concern that AI will bring more noise and findings. This concern is evidenced by CRR platforms exhausting their growth story, experiencing a plateau in adoption.

This blog explains why we at Forrester are making the change from cyber risk ratings to third-party cyber risk intelligence; defines third-party cyber risk intelligence; and outlines what CISOs need to do in the next three years to deliver value to their third-party risk programs (TPRMs).

Cybersecurity Risk Ratings Won The Market But Lost The Mission

The Forrester Wave™: Cybersecurity Risk Ratings Platforms, Q2 2026 and Buyer’s Guide: Cybersecurity Risk Ratings Platforms, 2026…