Two-thirds of respondents said their third-party supply chain had an immature information security posture.