Third-Party Risk: How to Vet Vendors Before They Become Your Breach

The most dangerous moment in a vendor relationship is often the one nobody thinks about: the day the contract is signed. Once a vendor is connected to your systems, holding your data and embedded in your operations, your leverage to demand security improvements drops sharply. Problems discovered later are harder, slower and more expensive to fix.

That’s why the strongest third-party risk programs focus on getting due diligence right before onboarding. Here’s a practical approach to vetting vendors before they become your breach.

Start with what the vendor will touch

Before asking a single security question, define the relationship. What data will the vendor access or store? Will they connect to your network or systems? Will they have privileged access? How critical are they to operations, and what happens if they go offline for a week?

Those answers determine how deep your review should go. A vendor handling customer payment data or administering your infrastructure deserves far more scrutiny than one providing office supplies.

The questions that matter most

For higher-risk vendors, focus on the controls most closely tied to real breaches:

• Identity and access: Do they enforce MFA for all employees, especially administrators? How do they control access to customer data?
• Data protection: Is your data encrypted in transit and at rest? Is it segregated from other customers? Where is it stored, and who can see it?
• Incident history and response: Have they had a significant breach? How quickly will they notify you of an incident, and what support will they provide?
• Vulnerability management: How fast do they patch critical vulnerabilities? Do they conduct penetration tests, and will they share summaries?
• Their own suppliers: Which subcontractors and cloud providers will handle your data, and how do they vet them?
• Business continuity: Can they recover quickly from ransomware or outages? When did they last test it?
• AI usage: Do they use AI tools or models that process your data, and is your data used for training?

Verify, don’t just trust

Questionnaire answers are claims, not evidence. Ask for independent assurance such as SOC 2 Type II reports or ISO 27001 certifications, and actually read the exceptions and scope sections. A SOC 2 report that doesn’t cover the service you’re buying offers limited comfort. Supplement with external security ratings, breach history searches and, for critical vendors, a conversation with their security team.

Watch for red flags

• Reluctance to share security documentation or answer basic questions
• No MFA for employees or administrators
• Vague or slow breach notification commitments
• Heavy reliance on undisclosed subcontractors
• Security reports that are outdated or exclude key services

Lock it into the contract

Due diligence only protects you if commitments are enforceable. Include requirements for security controls, breach notification timelines, audit rights, data return and deletion at termination, limits on subcontracting, and liability and insurance provisions. If gaps were identified, document a remediation plan with deadlines before go-live.

Grant only the access needed

Once approved, give vendors the minimum access required, use separate accounts with MFA, monitor their activity and review access regularly. Many vendor-related breaches stem from excessive or forgotten access rather than weaknesses at the vendor itself.

The bottom line

Your security is only as strong as the vendors you trust with your data and systems. Rigorous, risk-based vetting before signing, backed by enforceable contracts and limited access, is the most effective way to keep a vendor’s weakness from becoming your breach.