Understanding the Cyber Risks of Third-Party Vendors

Third-party vendors are essential to many business operations, but the access and dependencies they create can also introduce significant cyber risk. That exposure is becoming a central concern for organizations because an incident involving one provider can have far-reaching consequences.

“Attackers are increasingly viewing vendors as a more efficient route into their ultimate targets,” said Spencer Timmel, Head of Cyber Insurance at Safety National. “Rather than attacking a well-defended organization directly, a threat actor may compromise a software provider, cloud platform, managed service provider, payroll company, claims administrator, or other partner that has trusted access to multiple customers. This creates a multiplier effect: one compromised vendor can expose hundreds or even thousands of organizations.”

A Cybersecurity and Business-Resilience Issue

A recent report found third-party involvement in 48% of breaches in its dataset, reportedly representing a 60% increase from the prior year. The report also identified the exploitation of vulnerabilities as a leading way attackers gained access, highlighting the risks associated with widely used software and internet-facing systems.

Several trends are contributing to the broader challenge:

• Greater dependence on cloud services, software-as-a-service, and outsourced technology operations.
• Increasing use of vendors with privileged network access or access to sensitive information.
• Concentration risk, where many organizations depend on the same technology providers.
• Limited visibility into fourth parties (providers used by vendors) and other subcontractors.
• Delayed remediation of vulnerabilities in vendor-managed systems.
• Credential theft involving vendor accounts, remote-access tools, and service accounts.
• Ransomware attacks that disrupt a vendor’s customers even when customer data is not directly stolen.

Vendor risk has become both a cybersecurity issue and a business-resilience issue. A vendor incident can interrupt critical operations, compromise confidential information, create regulatory obligations, and damage customer trust. Guidance from the National Institute of Standards and Technology (NIST) treats cybersecurity supply-chain risk management as an enterprise-wide discipline covering the lifecycle of products and services, rather than simply a procurement checklist completed before signing a contract.

Why Vendor Oversight Should Reflect the Risk

Privacy obligations and contractual data-protection requirements add another layer to third-party risk. One of the central challenges is maintaining visibility and control over personal information after it leaves an organization’s direct environment.

Companies may know that a primary vendor receives data, but they do not always know where that data is stored, which employees can access it, whether it is used for secondary purposes, or which subcontractors receive it. That lack of visibility can make data mapping and transparency difficult, particularly when an organization does not have a complete inventory of the personal information shared with vendors.

Subprocessor oversight, data minimization and retention, incident notification, and the use of AI can complicate vendor relationships. A more proactive due-diligence process may help organizations identify potential cyber and privacy exposures before an incident occurs.

Building Due Diligence Around Exposure

For vendors that present meaningful risk, due diligence may include:

• Security and privacy documentation. Review independent audit reports and certifications where appropriate, such as System and Organization Controls (SOC) reports or relevant International Organization for Standardization (ISO) certifications. These should supplement, not replace, a risk-based assessment.
• Control validation. Evaluate controls such as multifactor authentication, encryption, vulnerability management, endpoint detection, logging, secure software development, access reviews, network segmentation, and backup protection.
• Data-governance review. Document the types of information the vendor will receive, why it is required, where it will be stored, how long it will be retained, and whether it will be shared with subprocessors.
• Business-continuity analysis. Assess recovery capabilities, backup architecture, recovery objectives, crisis communications, and the organization’s alternatives if the vendor becomes unavailable.

Incident provisions may also warrant consideration. Depending on the relationship and the risks involved, contracts may address timelines for reporting suspected security incidents affecting the organization’s data or services — not only confirmed breaches — as well as expectations for preserving evidence, providing updates, and cooperating with forensic, legal, regulatory, and notification activities.

Understanding Where the Risk Lives

As the threat landscape continues to change, vendor-risk practices may need to evolve with it. For many organizations, the near-term priority is not removing every dependency but gaining a clearer view of where critical exposures exist and how a vendor disruption could affect operations.

The objective should not be to eliminate all third-party risk, which is unrealistic. It should be to understand where the organization is dependent, reduce avoidable exposure, prepare for vendor failure, and make informed decisions about the risk that remains.