Vendor Risk: Your Security Is Only as Strong as Your Suppliers

The third-party reality

Your attack surface includes every vendor with access to your data or systems. Some of the largest breaches in recent years started not with the victim's own controls failing, but with a compromised supplier — a payroll provider, a support tool, a CI plugin.

Tier your vendors

Don't treat every SaaS subscription the same. Tier by data sensitivity and access:

Tier 1: handles customer PII, has production access, or could halt your business.
Tier 2: internal data, no production access.
Tier 3: marketing tools, no sensitive data.

Spend your diligence budget on Tier 1. A 50-question security review for a Tier 3 logo-design tool is wasted effort.

What to actually collect

For Tier 1 vendors:

Their SOC 2 or ISO 27001 report (read it — don't just file it).
Their breach-notification SLA in the contract.
The scope of data and access they actually need (enforce least privilege).
A subprocessor list, so you understand the chain.

Ongoing, not one-time

A vendor secure at onboarding can degrade. Re-review Tier 1 vendors annually, watch for their breach disclosures, and revoke access the day a vendor relationship ends — orphaned vendor credentials are a classic backdoor.

You can outsource the work, but you can't outsource the risk.

Vendor Risk: Your Security Is Only as Strong as Your Suppliers

The third-party reality

Tier your vendors

What to actually collect

Ongoing, not one-time

See Hosting Security in action

Related articles

Threat Modeling for Lean Teams: Finding the Risks Worth Fixing Before They Ship

A Security Onboarding Checklist for New Hires

Secure Device Disposal and Data Sanitization

Related articles

Risk Management
Threat Modeling for Lean Teams: Finding the Risks Worth Fixing Before They Ship
Most small teams find security problems the expensive way — after something breaks. Threat modeling is the cheap way: a structured, hour-long conversation about what could go wrong with a system before you build it, so the fixes land in the design instead of the incident report. A practical, jargon-light walk through the four questions, a lightweight STRIDE lens, and how to turn the output into tracked work rather than a diagram nobody reads.

Risk Management
A Security Onboarding Checklist for New Hires
Most teams have thought hard about what happens when someone leaves, but the first day is where access is granted, habits are set, and a lot of quiet risk gets baked in. A repeatable onboarding checklist — least-privilege access, MFA enrollment, device enrollment, an acceptable-use acknowledgment, and a way to prove it all happened — turns a scramble into a routine you can stand behind.

Risk Management
Secure Device Disposal and Data Sanitization
A retired laptop is not empty just because you dragged its files to the trash, and a stack of old drives in a closet is a data breach waiting to be discovered. Retiring hardware safely means deciding — per device and per data sensitivity — whether to clear, purge, or physically destroy it, getting proof when it matters, and tracking every asset all the way to end-of-life instead of losing it in a drawer.