Cássio Campos highlights shift in cybersecurity risk assessment

Cybersecurity leader and certification auditor Cássio Campos reports that attacks on technology organizations are increasingly targeting service supply chains. This shift has placed third-party assessment at the center of risk strategies, integrating security into the commercial calculations of corporate buyers, insurers, and institutional investors.

Based on audits within technology, financial services, and regulated sectors, Campos notes that security questionnaires are now required mid-sales cycle rather than just at contract closing. Contracts are increasingly including audit clauses, which can extend negotiation periods.

From an economic perspective, organizations are integrating security assessments into the purchasing process to estimate the potential costs of supplier failures, including service interruptions, data exposure, regulatory sanctions, and reputational damage. Suppliers with documented, verifiable controls can reduce these estimated costs, potentially increasing their willingness to pay and decreasing due diligence costs for buyers.

Campos will detail these methods in his upcoming book, ‘O Paradoxo da Liderança de Tecnologia’, scheduled for release in September 2026 by Rede Líderes and A7Z in São Paulo.