The Breach That Didn't Start With You

In early 2024, a massive data breach at Change Healthcare — a subsidiary of UnitedHealth Group — disrupted the entire U.S. healthcare payment system for weeks. The root cause? A threat actor exploited compromised credentials on a remote access portal that lacked multi-factor authentication. Change Healthcare was a vendor to thousands of hospitals and pharmacies. None of those downstream organizations were directly attacked, yet they all suffered the consequences.

That's third party vendor cybersecurity risk in its purest, most devastating form. Your organization's security posture is only as strong as the weakest vendor in your supply chain. And if you aren't actively managing that risk right now, you're betting your business on someone else's security budget.

This post breaks down how third party vendor risk actually works in practice, where most organizations fail, and the specific steps I've seen work in reducing exposure before an incident forces your hand.

Why Third Party Vendor Cybersecurity Risk Is Exploding

The 2024 Verizon Data Breach Investigations Report found that supply chain interconnection was a factor in 15% of all breaches — a 68% increase over the prior year. That number is almost certainly underreported. Many organizations don't even know which vendors have access to their environments, let alone which ones introduce the most risk.

Here's what's driving this trend. Modern businesses rely on dozens, sometimes hundreds, of third party vendors for payroll, cloud hosting, email filtering, legal services, IT support, and marketing analytics. Every one of those relationships creates a potential entry point for credential theft, ransomware, or data exfiltration.

I've worked with mid-sized companies that had over 200 active vendor relationships but had only formally assessed fewer than 10 of them for security posture. That gap is where breaches live.

The Trust Problem No One Talks About

Most vendor relationships are built on business trust — contracts, NDAs, and a handshake. But business trust is not the same as security trust. A vendor might be excellent at their core service and absolutely terrible at protecting their own infrastructure. You won't know until it's too late unless you ask the right questions upfront.

The CISA Cyber Supply Chain Risk Management guidance makes this point clearly: organizations must treat supply chain risk as a first-class security concern, not a compliance checkbox.

What Does Third Party Vendor Cybersecurity Risk Actually Look Like?

This is the question I see searched most often, so let me answer it directly.

Third party vendor cybersecurity risk is the potential for a security incident at an external partner, supplier, or service provider to compromise your organization's data, operations, or reputation. It manifests in several ways:

  • Credential compromise: A vendor's employee falls for a phishing email, and the stolen credentials provide access to your systems.
  • Software supply chain attacks: Malicious code is injected into a vendor's software update, which you install on your network. The SolarWinds attack in 2020 remains the textbook example.
  • Data exposure: A vendor misconfigures a cloud storage bucket containing your customer records.
  • Ransomware propagation: A vendor's network is encrypted by ransomware, and the attack spreads through interconnected systems to your environment.
  • Compliance violations: A vendor mishandles regulated data (HIPAA, PCI-DSS, GDPR), and your organization shares liability.

In every one of these scenarios, the threat actor doesn't need to attack you directly. They attack the softest target in your ecosystem and use that access to reach you.

The Five Failures I See Over and Over

After years of helping organizations build vendor risk programs, these are the patterns that keep repeating.

1. No Vendor Inventory

You can't manage risk you can't see. Many organizations have no centralized list of vendors with access to their data or systems. Shadow IT compounds this — departments onboard SaaS tools without security review all the time.

2. One-Time Assessments

Sending a security questionnaire during onboarding and never revisiting it is essentially worthless. Vendor risk is dynamic. A vendor that was secure last year may have laid off half their IT team this year.

3. No Tiering by Risk

Not all vendors pose equal risk. Your office supply company and your cloud infrastructure provider should not get the same level of scrutiny. Smart programs tier vendors by data access, system connectivity, and business criticality.

4. Ignoring Vendor Employee Training

Social engineering is the top initial access vector in most breaches. If your vendor's employees can't spot a phishing email, their weakness is your weakness. I recommend requiring key vendors to implement phishing awareness training for their organizations as a contractual requirement.

5. No Incident Response Coordination

When a vendor gets breached, the clock starts ticking on your response too. If you haven't pre-negotiated notification timelines, data preservation obligations, and communication protocols, you'll be scrambling when it matters most.

A Practical Framework for Managing Vendor Risk

Theory is easy. Here's the practical playbook I've seen work for organizations of all sizes.

Step 1: Build and Maintain a Vendor Inventory

Catalog every third party that touches your data, your network, or your employees. Include SaaS platforms, contractors, managed service providers, and anyone with remote access. Update this quarterly at minimum.

Step 2: Tier Your Vendors

Assign each vendor a risk tier based on three factors: the sensitivity of data they access, the depth of their network connectivity, and how critical they are to your operations. Tier 1 vendors get deep assessments. Tier 3 vendors get a standardized questionnaire.

Step 3: Assess Continuously, Not Once

Use a combination of security questionnaires, evidence requests (SOC 2 reports, penetration test results), and external attack surface monitoring. The NIST Cybersecurity Framework provides an excellent baseline for structuring these assessments.

Step 4: Enforce Contractual Security Requirements

Your vendor contracts should include specific security obligations: multi-factor authentication on all administrative access, encryption in transit and at rest, breach notification within 24-72 hours, and the right to audit. If a vendor won't agree to reasonable security terms, that tells you everything you need to know.

Step 5: Require Security Awareness Training

This is non-negotiable. Your vendors' employees are part of your extended attack surface. Require evidence that staff with access to your data have completed cybersecurity awareness training annually. It's one of the highest-ROI risk reduction measures available.

Step 6: Plan for Vendor Incidents

Develop a vendor incident response playbook. Know who to call, what data to preserve, and how to communicate with customers and regulators. Run tabletop exercises that include vendor breach scenarios at least once a year.

Zero Trust Isn't Just an Internal Strategy

Organizations are rapidly adopting zero trust architecture inside their networks — verify every user, every device, every session. But I see too many stop at the perimeter and implicitly trust vendor connections.

Apply zero trust principles to vendor access. Segment vendor connections. Enforce least-privilege access. Monitor vendor activity with the same rigor you apply to internal users. A vendor VPN connection with broad network access is a ticking time bomb. Treat it that way.

The Regulatory Pressure Is Real and Growing

Regulators have taken notice. The FTC has increasingly held organizations accountable for the security practices of their vendors, particularly when consumer data is involved. The SEC's cybersecurity disclosure rules now require public companies to describe their processes for managing risks from third party service providers.

If you're in healthcare, finance, or government contracting, vendor risk management isn't optional — it's a regulatory expectation with real enforcement teeth. But even if you're not in a regulated industry, the legal liability from a vendor-caused breach can be devastating.

Start Where You Are, Not Where You Want to Be

I get it — building a vendor risk management program from scratch feels overwhelming. But you don't need to solve everything at once. Start with your top 10 vendors by data sensitivity. Get an inventory. Send a questionnaire. Read the responses carefully. You'll be surprised how much risk surfaces in the first pass.

Third party vendor cybersecurity risk isn't a theoretical problem. It's one of the most common, most damaging, and most preventable attack vectors in modern business. The organizations that take it seriously aren't the ones with the biggest budgets — they're the ones that started before the breach forced them to.

Your vendors are part of your security perimeter whether you like it or not. Act accordingly.