The most significant cyber breaches of recent years share a detail that rarely makes the headline: In case after case, the attacker never broke through the front door. They were let in.
A third-party IT contractor whose help desk was social-engineered into a credential reset. A customer notification platform compromised through a stolen employee login. A cloud environment accessed via a vendor's misconfigured integration. In each case, the organisation's core defences were beside the point.
The pattern isn't coincidence. It's a structural gap in how most organisations scope their vendor risk programmes.
The standard model for vendor risk management is a tiered one. Tier 1 suppliers (large contracts, deep integration, operational criticality) receive formal assessments, periodic reviews and documented controls. Lower tiers receive less attention, proportionally.
The logic is defensible. But it contains a flaw.
Tiering by business criticality asks: How badly would operations suffer if this vendor failed? That’s a useful question, but it isn’t the only question.
Access proximity asks something different: What does this vendor have access to, and what could an attacker do with that access? An IT services contractor with the ability to reset employee credentials and disable MFA sits at the heart of your IT and cyber risk infrastructure, regardless of its tier classification or contract value. A customer communication platform with authenticated write access to your users' devices sits between your brand and your customers. Neither needs to be "critical" in the operational sense to be consequential in the security sense.
This is where most vendor risk programmes have a gap. Not in the top tier, where vendors are well-governed. The gap is in the layer below, i.e. the IT managed services provider, the marketing platform, the notification tool, the CRM add-on with API access to customer data. These vendors are on-boarded once, assessed lightly if at all and then largely left alone.
"Most vendor risk programmes ask the wrong question. 'How critical is this vendor to operations?' is a business continuity question. 'What can an attacker do with this vendor's access?' is a security question. The attacks making headlines make that distinction very expensive to ignore."
— Bram Ketting, Vice President, Business & Product Strategy, Diligent
Closing this gap requires a sharper scoping question at on-boarding and a monitoring model that does not treat assessment as a one-time exercise.
For any vendor with privileged access to identity systems, customer channels or core data infrastructure, the questions should include:
Continuous monitoring matters here in a way that point-in-time assessments cannot replicate. A vendor's security posture, personnel and sub-processor relationships change. The access permissions granted at on-boarding become stale. An organisation that reviews its top-tier vendors annually but never revisits the access model for its IT managed service provider is working with a static picture of a dynamic risk.
"A point-in-time vendor assessment tells you what the risk looked like on the day someone filled in a questionnaire. That's not monitoring, that's a snapshot. Most organisations don't have a current picture. They have a completed form filed somewhere and a calendar reminder to repeat it in 12 months."
— Bram Ketting, Vice President, Business & Product Strategy, Diligent
The audit trail matters too. When regulators and boards ask, and after incidents like these they will ask, the question is not just whether a breach occurred but whether due diligence was performed, whether access was reviewed and whether the organisation understood its exposure. That is a hard position to defend if the vendor in question was assessed once at on-boarding and never revisited.
"In the first 72 hours after a third-party breach, your board and regulators will ask two questions: What happened and what did you have in place to prevent it? You can't always control the answer to the first. The risk programme doesn't just need to manage risk. It needs to produce evidence that risk was managed."
— Bram Ketting, Vice President, Business & Product Strategy, Diligent
Recent high-profile incidents share a common thread: In each case, the attack surface was a vendor with legitimate, authenticated access to something that mattered. The exploitation was sophisticated in execution but straightforward in principle: Find the vendor, find the gap in how that access is governed, use it.
That gap is not unknowable. It shows up in vendor inventories that have not been reviewed since onboarding. It shows up in access permissions that have never been revisited. It shows up in tiering models that measure operational criticality but not access proximity.
Pull up your vendor inventory. Find the vendors with access to your identity infrastructure, your customer communication channels and your core data systems. Ask when each was last assessed. Ask who owns the review. If those answers are not immediately available, that is where the programme needs to go next.
Want to know where your programme has gaps? Diligent 3rdRisk is built for exactly this layer of the vendor estate. Talk to us.
From policy to practice: Why KPMG chose 3rdRisk for third-party risk management
Discover how KPMG's partnership with 3rdRisk revolutionizes third-party risk management by seamlessly integrating advisory expertise with a purpose-built TPRM platform, empowering organizations to transition from theoretical policies to actionable risk management in response to evolving regulations like DORA and NIS2.
