Why third-party risk matters

Organisations share data and network access with dozens or hundreds of suppliers. An attacker who compromises a payroll provider, IT managed service provider or software vendor can reach every customer that supplier serves. Many recent high-profile incidents started with a supplier rather than the organisation that suffered the impact.

In the UK, the NCSC's supply chain guidance and regulations such as DORA for financial services and the Cyber Security and Resilience Bill all place growing emphasis on understanding supplier risk.

The TPRM lifecycle

  1. Inventory suppliers and what data or access each one has.
  2. Tier them by criticality, so the most important get the closest scrutiny.
  3. Assess them through questionnaires, certifications such as ISO 27001 or Cyber Essentials, and outside-in evidence.
  4. Contract for security requirements, breach notification and right to audit.
  5. Monitor continuously for breaches, exposed systems and leaked data.
  6. Offboard properly, removing access and data when the relationship ends.

Questionnaires vs continuous monitoring

Questionnaires show what a supplier says it does at a point in time. Outside-in monitoring shows what is actually visible: exposed services, unpatched vulnerabilities, leaked credentials and breach mentions. Using both gives a far more reliable picture than either alone.

How DarkInvader helps

DarkInvader's Supplier Risk Management scores suppliers using external evidence, including breach, leaked credential and dark web monitoring alongside surface web OSINT, and checks key accreditations such as ISO 27001, so you can see which suppliers pose the greatest risk.

Explore Supplier Risk Management

Frequently asked questions

What is the difference between third-party and fourth-party risk?

Third-party risk comes from your direct suppliers. Fourth-party risk comes from your suppliers' suppliers, such as the cloud or software providers they rely on, which you have no direct contract with.

Which suppliers should be assessed first?

Those with access to sensitive data or your network, and those your critical services depend on. Tiering suppliers by criticality keeps the effort proportionate.

Is a security questionnaire enough to assess a supplier?

Not on its own. Questionnaires are self-reported and quickly go out of date. Combining them with certifications and continuous outside-in monitoring gives a much more accurate view.

Related terms and reading

Sources