UTRS InfoSec Launches Third-Party Risk Advisory Service as Vendor Breaches Accelerate
New UTRS InfoSec service helps growing businesses inventory, assess, and monitor vendor risk without building an
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
New UTRS InfoSec service helps growing businesses inventory, assess, and monitor vendor risk without building an enterprise-scale program.
Marlton, NJ October 06, 2026 –(PR.com)– UTRS InfoSec LLC, a division of Universal Technical Resource Services, Inc. (UTRS), today launched its Third-Party Risk Advisory Service, a program that helps small and mid-sized businesses build, run, and document oversight of the vendors they depend on.
The timing follows a string of breaches that trace back not to the victim organization, but to a vendor it relied on. In September, Canva disclosed that enterprise customer data, including names, business contacts, and contract documents, had been exposed through Canny, a third-party feedback platform with access into Canva’s Salesforce environment. Canva’s own systems were never touched. The exposure came entirely through a vendor’s vendor, the exact kind of indirect exposure most businesses have no process for catching.
It is not an isolated case. According to the Ponemon Institute’s 2025 Third-Party Risk Management Study, 61 percent of organizations experienced a data breach caused by a third party in the past twelve months, and fewer than one in three had a formal vendor risk program in place when it happened. Verizon’s 2025 Data Breach Investigations Report found that third-party involvement in confirmed breaches doubled year over year, from 15 percent to 30 percent. The IBM 2024 Cost of a Data Breach Report put the average cost of a third-party breach at $4.29 million, nearly $300,000 more than breaches that started internally.
“Every business runs on vendors now: payroll, cloud storage, customer support tools, payment processing,” said Larry J. Hershman, CISSP, Managing Director, UTRS InfoSec. “The Canva incident shows the risk doesn’t even stop at the vendors you chose. It extends to the vendors your vendors chose. Most businesses have no visibility into that at all, and that’s exactly the gap this service is built to close.”
What the Service Provides
• Vendor Inventory and Tiering — Mapping a business’s full vendor population, including data access and system connections, and tiering vendors by the risk they actually pose rather than treating every relationship the same.
• Evidence-Based Assessments — Direct vendor outreach and evaluation of SOC 2 reports, cyber insurance coverage, incident response plans, and contractual protections, rather than relying on a questionnaire alone.
• Risk Register and Documentation — A documented finding and rationale for every vendor decision, producing a record that holds up if a customer, insurer, or partner ever asks how a vendor was vetted.
• Ongoing Managed Monitoring — Continuous tracking of vendor posture, reassessment cycles, and alerts on material changes, including new subprocessors added after the initial review.
For businesses in regulated industries, the service can also be aligned to specific compliance obligations such as HIPAA, CMMC, PCI DSS, or the FTC Safeguards Rule. The service is available as a standalone engagement or as part of an existing UTRS InfoSec vCISO advisory relationship.
Availability
UTRS InfoSec’s Third-Party Risk Advisory Service is available now to businesses of any size looking to understand and manage their vendor exposure. Details are at utrsinfosec.com and in UTRS’s recent feature, “Everyone Has a Plan, Until Their Vendor Gets Breached.”
About UTRS InfoSec LLC
UTRS InfoSec LLC provides vCISO services, compliance advisory, and third-party risk management to businesses across healthcare, financial services, defense contracting, legal, higher education, professional services, and beyond. Its offensive security practice delivers penetration testing and red team engagements, and its managed detection and response capability provides continuous monitoring and incident response across endpoints, identity, and cloud environments. UTRS InfoSec’s advisors bring more than 25 years of experience translating security obligations into decisions business leaders can act on.
About Universal Technical Resource Services, Inc.
Founded in 1985, Universal Technical Resource Services, Inc. (UTRS) provides engineering, manufacturing, and information technology services to public and private sector clients across defense, civil government, state and local government, industrial, and commercial markets. UTRS InfoSec is UTRS’s information security and compliance solutions provider to municipalities and the private sector.
Contact Information:
UTRS InfoSec LLC
Larry J. Hershman, CISSP
877-651-1835
Contact via Email
https://www.utrsinfosec.com/
Managing Director
Read the full story here: https://www.pr.com/press-release/981109
Press Release Distributed by PR.com
Media gallery
