Your cyber security is only as strong as the people you’ve allowed through the door, and some of those people don’t work for you. That is the uncomfortable reality of third-party risk.
By John Mc Loughlin, CEO of J2 Software
Modern businesses depend on IT providers, accountants, payroll companies, cloud platforms, software vendors and consultants that may have access to systems, data, accounts or networks that are critical to the organisation.
The scale of the problem is becoming harder to ignore. Gartner has identified third party and supply chain compromise as a growing cyber security concern, warning that organisations can be exposed through vendors and technology partners that sit outside their direct security controls.
The World Economic Forum’s 2026 Global Cybersecurity Outlook similarly identifies supply chain vulnerabilities as a significant cyber risk, reinforcing the need for organisations to look beyond their own perimeter when assessing security.
You can control your own security, but you cannot control how securely every third party operates. If one of them is compromised, your business can become the victim. Sending suppliers a security questionnaire, getting it completed and filing it away is not security. Your supplier can give you excellent answers in January and have a compromised employee, stolen credentials or vulnerable system in February.
The first step is understanding who has access to your business and why. A third party may have access to Microsoft 365, business applications, sensitive data, endpoints or administrative systems. Sometimes that access has accumulated over years and nobody is quite sure whether it is still required.
Give people and suppliers the access they need, rather than the access they might possibly need, and remove access when it is no longer required.
The uncomfortable reality is that businesses don’t control the security of their suppliers. Their employee can be phished, their password can be stolen, their laptop can be infected or their cloud account can be taken over.
The cybercriminal doesn’t care whether the compromised person works for you or someone you have contracted to work for you. If that identity has access to your business, it becomes your problem.
You may not be able to see everything happening inside your supplier’s organisation, but you should be able to see what their accounts are doing inside yours. Is someone logging in at an unusual time? Are they accessing systems they don’t normally use? Are they suddenly downloading large amounts of data? Are they creating new accounts or changing permissions? These are the signals that can turn third party risk from an unknown into something you can actually manage.
There is no such thing as a business with zero third party risk. A supplier delivering stationery presents a very different risk from an outsourced IT provider with privileged access to your entire network. Risk needs to be prioritised based on access and potential impact.
Many organisations focus on whether a supplier has the right policies and certificates rather than asking what would happen if that supplier was compromised tomorrow.
Outsourcing a service does not outsource the consequences. If a supplier is compromised and the attacker uses that relationship to access your business, your customers aren’t going to call the supplier first. You will get that call. Know who has access, understand what they can reach, reduce unnecessary privileges, protect the identities being used, monitor activity and have a plan to disable access quickly.
You cannot make every organisation in your supply chain perfectly secure, but you can make your own business harder to compromise, easier to monitor and better able to respond when something goes wrong.
Perhaps the most important question to ask is not, “Is my supplier secure?” It should be, “What will happen in my business if they aren’t?” That is where third party risk becomes cyber resilience.