Security used to be organised around a defensible perimeter: the company’s own network, its own data centres, its own employees. Build strong enough walls around that perimeter, and the organisation was reasonably safe. That assumption has quietly collapsed. Cloud infrastructure, SaaS platforms, outsourced operations, and deeply interconnected supply chains mean a meaningful share of an organisation’s actual risk now sits inside systems it doesn’t own, can’t patch, and often can’t even see.
The pattern shows up repeatedly: a company with genuinely strong internal controls gets breached anyway, not through its own front door but through a vendor, a managed service provider, or a software component it relied on without fully understanding.
The attacker didn’t need to beat the target’s defences — only to find the weakest link in its extended ecosystem.
From control to visibility
This changes what the job is. A CSO can mandate a control on internal infrastructure. On a vendor’s infrastructure, the CSO has no such authority — the job shifts from enforcing control to building visibility and leverage over relationships that were never designed to be controlled directly.
What building real oversight looks like
01
Continuous visibility, not annual questionnaires
A vendor risk assessment completed at onboarding is stale within weeks. Continuous monitoring — attack-surface scanning, breach-disclosure tracking and security ratings — keeps vendor risk a live picture, not a filing cabinet.
02
Contractual leverage, set before an incident
Security requirements, audit rights, breach-notification timelines and termination rights need to be written into the contract before it is signed — not requested once leverage has disappeared.
03
Map concentration and fourth-party risk
The real exposure is often who a vendor depends on. Shared cloud providers, payment processors and software libraries can create a single point of failure across the ecosystem.
04
Coordinate incident response across the relationship
Who notifies whom, on what timeline, and who speaks to customers first? Those answers belong in contracts and playbooks before the incident, not in a tense call while it is live.
A governance question
This is a governance question, not only an operational one. A board that asks whether the company has SOC 2 reports on file is asking the wrong question.
The question to ask
Which vendors, if breached or suddenly unavailable, would materially disrupt this business — and do we know the answer?
Key takeaways
- Much of today’s risk sits with vendors you don’t own, can’t patch and often can’t see.
- Replace annual questionnaires with continuous monitoring, and set your leverage in the contract before signing.
- Map who your vendors depend on, and agree incident roles before something happens.
At Percys, we treat third-party and supply-chain exposure as one of the areas where the gap between what a board assumes is covered and what is understood tends to be widest — and closing that gap is one of the highest-leverage things a CSO can bring into the boardroom.
RELATED READING
