Third Party Risk Is Your Attack Surface Are You Reviewing Vendors Effectively
A company can patch its own systems, harden its cloud, train staff, and still be exposed through a supplier it barely reviews. That is no longer an edge case. It is one of the main ways attackers reach business data and critical services.
Verizon’s 2025 Data Breach Investigations Report (DBIR) reported that breaches involving a third party doubled to 30%. That figure matters because it turns supplier risk from a procurement concern into a core security issue. If almost one in three breaches involves an external party, then the supplier base is part of the attack surface.
For financial entities, technology providers, risk owners, procurement teams, and security leaders, the question is no longer whether suppliers create exposure. They do. The question is whether exposure reviews include them in a way that is detailed enough to reduce real risk.
Third-party breaches have moved from exception to pattern
The Verizon DBIR 2025 finding is a warning sign because third-party involvement has not just increased, it has doubled to 30%. That does not mean every supplier is high risk. It means the connection between supplier operations and customer exposure is now too material to treat as a questionnaire exercise.
A supplier can increase risk in several ways:
It may process sensitive business or customer data.
It may connect to internal systems through remote access.
It may provide software, cloud services, payment services, identity tools, or managed IT services.
It may rely on its own subcontractors, creating fourth-party exposure.
It may suffer an incident that disrupts the customer’s service, even if customer data is not stolen.
This is why third-party cyber risk belongs in exposure management. A vendor that has privileged access, stores regulated data, or supports an important business service can be as relevant as an internet-facing server.
A common mistake is to separate supplier review from technical exposure review. Procurement checks contracts. Risk teams review questionnaires. Security teams scan owned assets. Each activity has value, but gaps appear when nobody joins the picture.
For example, a software provider may pass a basic security questionnaire but also use an outdated file transfer platform. A managed service provider may have access to production systems but no clear limit on user permissions. A cloud service may host customer files in a region that conflicts with internal policy. These issues may not appear if the review only asks whether the supplier has policies.
The rise in third-party breaches shows the need to test how suppliers touch the business, not only whether they say they are secure.
Your supplier list is not the same as your exposure map
Most organisations have a supplier register. Fewer have a clear map of which suppliers can affect confidentiality, integrity, or availability.
A supplier register usually answers basic questions:
Who provides the service?
Who owns the contract?
When does the contract renew?
What is the annual spend?
An exposure map goes further. It answers security and operational questions:
What data does the supplier access, store, or process?
Which systems does the supplier connect to?
Does the supplier have administrator access?
Does the supplier support a critical business service?
Which subcontractors support the service?
What happens if the supplier is unavailable for 24 hours, 48 hours, or a week?
How quickly must the supplier notify an incident?
Who inside the organisation can disable access or switch provider?
These questions link supplier management to the supply chain attack surface. They also help prioritise effort. A catering supplier and a cloud payment provider do not need the same level of security review. A low-cost software tool can create high risk if it stores employee data or connects to identity systems.
A practical model is to classify suppliers by impact rather than spend.
Supplier type | Exposure question | Review depth |
Critical technology provider | Could failure or compromise stop an important service? | Full exposure review, yearly reassessment, incident testing |
Data processor | Does the supplier handle personal, financial, or confidential data? | Data flow review, contract controls, security evidence |
Privileged access provider | Can the supplier access internal systems or admin functions? | Access review, logging checks, approval controls |
Standard service provider | Limited data and no system access | Basic review and contract clauses |
This helps procurement, risk, and security work from the same facts. It also prevents two common failures, over-reviewing low-risk suppliers and under-reviewing high-risk suppliers.
How to include vendors in exposure reviews effectively
A good exposure review does not ask, “Is this supplier secure?” That question is too broad. It asks, “How could this supplier create exposure for us, and what evidence shows the risk is controlled?”
That shift makes the review more useful.
Start with the services that matter most
Begin with critical services and high-risk data. For a financial entity, this may include payment processing, customer portals, identity and access tools, cloud hosting, fraud monitoring, trading systems, call-centre platforms, and data analytics services.
For an ICT provider, it may include development platforms, hosting providers, ticketing tools, remote support tools, monitoring services, and software components used in customer environments.
The first review should focus on suppliers that meet one or more of these conditions:
They support a critical or important business function.
They handle regulated or sensitive data.
They have privileged access.
They provide security, identity, cloud, or network services.
They are hard to replace quickly.
They rely on subcontractors for key parts of the service.
This keeps the review grounded in real exposure, not paperwork volume.
Build a clear access and data picture
For each priority supplier, document the paths into and out of the organisation. The review should show:
Data types shared with the supplier.
Systems the supplier can access.
User accounts used by the supplier.
Access method, such as portal, secure connection, or remote support tool.
Locations where data is stored or processed.
Subcontractors involved in delivery.
Logs available to detect unusual activity.
Named business and technical owners.
This does not need to be complex at first. A simple diagram and a short control sheet can reveal gaps quickly. The point is to make access visible.
Many incidents worsen because supplier access remains active after a project ends, or because shared accounts make activity hard to trace. Exposure reviews should include access removal and account ownership as standard checks.
Ask for evidence, not only answers
A questionnaire can support a review, but it should not be the review. Suppliers may answer “yes” to broad questions without showing how controls work.
Better evidence includes:
A recent independent security report, where available.
Summary results from penetration testing, with sensitive details removed.
Certification scope, not just the certificate name.
Incident response process and notification timelines.
Backup and recovery test results.
Access control records for the customer environment.
Subprocessor lists and change notification process.
Vulnerability management process and patch timelines.
Evidence should match the risk. A critical provider should face deeper review than a low-risk service. The review should also record gaps and agreed remediation dates.
Make exposure review a lifecycle activity
A vendor risk assessment at onboarding is not enough. Supplier exposure changes. Contracts expand. New data flows appear. Subcontractors change. A tool bought for one department becomes business critical.
Trigger a review when any of the following happens:
The supplier gains new system access.
New categories of data are shared.
A service becomes critical to operations.
The supplier changes hosting location or key subcontractors.
A major vulnerability affects the supplier’s technology.
The supplier reports an incident.
The contract is renewed or expanded.
A review calendar helps, but event-based review is often more important. Risk changes when the service changes, not only once a year.
DORA turns supplier visibility into a compliance requirement
The Digital Operational Resilience Act, known as DORA, applies across the European Union from 17 January 2025. It sets requirements for financial entities and information and communication technology providers involved in financial services.
One of its most practical effects is the pressure it creates to know which ICT third-party providers support critical or important functions. The DORA register of information is central to that pressure. It requires financial entities to maintain structured information on their ICT third-party arrangements.
This register is more than an administrative file. It acts as a forcing function in three ways.
It makes ownership visible.
A register needs named services, providers, functions, and contractual details. That forces the organisation to identify who owns each supplier relationship and which business function depends on it.
It connects contracts to operational risk.
Regulators are not only interested in whether a contract exists. They expect financial entities to understand concentration risk, subcontracting, exit plans, incident reporting, and the impact of failure.
It creates a common reference point.
Security, procurement, legal, compliance, business continuity, and operations can work from the same supplier data. This reduces conflicting records and helps teams respond faster during incidents.
For ICT providers, DORA also changes expectations. Financial sector customers may ask for more precise evidence, clearer subcontractor information, stronger incident notification terms, and better testing records. Providers that can answer these questions well will reduce friction during onboarding and renewal.
The register should not be treated as a one-off compliance task. If it is maintained well, it becomes a useful risk management tool. If it is filled out once and ignored, it becomes another stale spreadsheet.
Practical strategies to reduce supplier exposure
Supplier risk cannot be removed. It can be reduced, monitored, and managed with discipline. The following strategies help turn exposure reviews into measurable control.
Rank vendors by impact and access
Create a risk tiering model based on:
Criticality of the supported service.
Sensitivity of data handled.
Level of system access.
Operational dependency.
Availability of alternatives.
Subcontractor reliance.
Regulatory relevance.
This ranking should drive the depth and frequency of review. High-impact suppliers need deeper checks, stronger contract terms, and closer monitoring.
Limit and monitor supplier access
Supplier access should follow the least access needed for the job. That means:
No shared accounts where individual accounts are possible.
Time-limited access for projects.
Separate administrator accounts.
Multi-factor authentication, which requires more than a password to log in.
Regular review of active accounts.
Logging of supplier activity in critical systems.
If a supplier does not need standing access, do not grant it. If standing access is needed, review it often.
Strengthen contract clauses before an incident
Contracts should support fast action during a security event. Key clauses should cover:
Incident notification timelines.
Right to receive relevant security information.
Subcontractor disclosure and change notification.
Data location and transfer limits.
Audit or assurance rights.
Business continuity and recovery requirements.
Exit support and data return or deletion.
Minimum security controls for the service.
Legal wording alone will not stop an attacker, but weak contracts slow response and limit visibility when speed matters.
Test supplier incident scenarios
Run short exercises for critical suppliers. Keep them practical. For example:
A cloud provider outage affects a customer portal.
A managed service provider account is suspected of misuse.
A software supplier reports a vulnerability in a product used internally.
A data processor reports unauthorised access.
The goal is to check decisions, contact paths, evidence needs, and service recovery steps. A one-hour exercise can expose missing contacts, unclear owners, and unrealistic recovery assumptions.
Track fourth-party risk where it matters
Fourth parties are the suppliers used by suppliers. Not every fourth party needs direct review, but critical dependencies should be known.
Ask high-impact suppliers:
Which subcontractors support the service?
Which subcontractors can access data?
Where are they located?
How are changes communicated?
What controls apply to them?
What happens if they fail?
This is especially relevant for cloud hosting, customer support, software development, data processing, and managed services.
Keep a live issue log
Every finding should have an owner, due date, and decision. Some risks can be fixed. Some are accepted. Some require contract changes. Some require an exit plan.
A useful issue log includes:
Supplier name.
Exposure identified.
Business impact.
Risk decision.
Agreed action.
Owner.
Target date.
Status.
Without this, reviews produce reports but little change.
What a mature supplier exposure review looks like
A mature process has a few clear signs.
The organisation can list its most critical suppliers quickly. It knows which providers support important business services. It can see which suppliers access sensitive data or internal systems. It has current contacts for incident response. It can explain which supplier risks are accepted and why.
The same process also improves procurement decisions. A supplier with weak controls may still be used, but only with compensating measures, tighter access, contract changes, or an exit plan. A supplier with strong evidence and clear processes can move more smoothly through approval.
For financial entities, this discipline supports DORA readiness. For ICT providers, it supports customer trust and smoother assurance reviews. For security and risk teams, it gives a realistic view of the attack surface.
The key is to treat supplier exposure as operational reality, not a compliance side task.
The next breach may start outside your walls
The Verizon DBIR 2025 figure should change priorities. If third-party involvement has doubled to 30%, supplier exposure deserves the same attention as internet-facing systems, user accounts, and critical applications.
A strong review process should answer four questions:
Which suppliers matter most?
How do they connect to systems, data, and services?
What evidence shows the risk is controlled?
What will happen if they fail or are compromised?
Businesses that can answer those questions are better prepared for audits, incidents, contract renewals, and regulatory scrutiny. Businesses that cannot may only discover supplier exposure after an attacker, outage, or regulator finds it first.
Review our attack surface review page to explore how our services can help enhance your security posture and effectively manage risks associated with your suppliers. Discover tailored strategies and insights that can empower your organization to stay ahead of potential threats.
