Third-Party Risk 101:
why vendor questionnaires fail
What third-party risk management is, why the spreadsheet approach breaks, and what better looks like.
Joshua Marpet and Cairn Viktor
Their breach becomes your breach
Attackers first got in with credentials stolen from an HVAC and refrigeration vendor that had remote access to Target’s network.
Ransomware went through a flaw in IT management software used by managed service providers, reaching their downstream customers.
Attackers slipped a malicious file into a software update, signed with SolarWinds’ own legitimate code signing certificate.
The CL0P ransomware gang exploited a flaw in a file transfer product and stole data from the databases behind it.
What third-party risk management is
- A third party is anyone outside your organization who touches your data, your systems or your operations.
- That includes suppliers, software and cloud services, IT providers, contractors, and the open-source code inside your products.
- Third-party risk management (TPRM) is the practice of knowing who they are, how much you depend on each one, and what happens if one fails.
- Your vendors have vendors too. Risk flows down the whole chain, not just one link.
How most programs work
Most of the effort lands in one step: the assessment. And most assessments are a spreadsheet.
List every third party you use.
Rank them by how much they can touch or break.
Ask about their security, usually with a questionnaire.
Write security terms into the agreement.
Check again, usually once a year.
“Do you require multi-factor authentication?” Yes.
The vendor types the answer. Nobody checks it. It goes in a folder until next year.
Four structural problems
The vendor grades its own homework. The incentive is to check every box, not to tell the truth.
An answer is true, at best, on the day it was written. Systems and people keep changing.
A “yes” is a claim, not proof. There is no setting, log or report behind it.
Each customer sends its own form, so vendors spend their time on paperwork instead of security.
What the Target report found
The risk lived in the access Target gave the vendor, not in anything the vendor wrote on a form.
A phishing email stole the HVAC vendor’s credentials.
That vendor had remote access to Target’s network for billing and project work.
The Senate staff report says Target rarely required two-factor authentication from its low-level contractors.
It also says alerts fired when the malware arrived.
Even the numbers need a definition
Change the definition and the answer moves by a factor of two to three. A single number on a form hides that choice.
open-source packages classified in VCRI’s Q3 2026 State of the Supply Chain report.
npm’s risk-weighted rate of packages that are abandoned, archived, deprecated or superseded, depending on how you define “still maintained.”
Four upgrades
Ask for what systems produce: settings exports, scan results, software bills of materials, not typed answers.
Check on a rhythm that matches how fast things change, not once a year.
Answer once, share with every customer, in a format anyone can check.
Spend the most effort on the vendors whose failure would hurt the most.
Swap the claim for the proof
| Instead of asking | Ask to see |
|---|---|
| Do you require MFA? | An identity provider export showing MFA enforced, including for contractors |
| Do you patch promptly? | Recent scanner results with dates |
| Do you track your software components? | The SBOM file itself |
| Do you have an incident plan? | The date and findings of your last exercise |
Start small, start with access
- List the vendors that have accounts or remote access into your systems.
- Pick your top five by what they could reach or break.
- For each one, replace one questionnaire item with a request for evidence.
- Check that a second factor is actually enforced on every vendor account.
- Try a free, open scorer, such as VCRI’s BeaconScore, to see what evidence-based grading looks like.
Free to use, teach and share.
This deck is part of the VCRI Learn series. Use it in your class, your team meeting or your chapter, with credit to The Value Chain Risk Institute.
valuechainrisk.org/learn