A change-aware, AI-assisted framework for dynamic third-party cybersecurity risk assessment

Organizations increasingly depend on third-party vendors, cloud providers, and outsourced technology partners, expanding the cybersecurity attack surface beyond direct organizational control. Prevailing third-party risk assessment practices are largely static and onboarding-focused, so post-onboarding changes such as access expansion, application programming interface integration, and increased data exposure can alter vendor risk without triggering reassessment. This study proposes a change-aware, AI-assisted framework that links structured post-onboarding change indicators to dynamic risk reassessment and to rule-based mitigation retrieval, and evaluates it as a proof-of-concept on simulated data. Risk labels are generated by a governance-aligned matrix (risk = likelihood × impact, with confidentiality, integrity, and availability components) that is used only to define ground truth; the classifier is trained solely on observable scenario inputs (four contextual factors and the change-event type), with no access to the label-deriving quantities. On a balanced dataset of 600 simulated scenarios evaluated with stratified five-fold cross-validation, a Random Forest classifier reached 58% exact accuracy and 93% within-one-level accuracy, exceeding a static rank-based rule (39%) and a no-information baseline (20%). The results demonstrate technical feasibility on synthetic data only; they are not evidence of real-world effectiveness. We therefore frame the contribution as a transparent, reproducible proof-of-concept and identify validation on real vendor data as essential future work.