Definition
Third-party risk, also known as vendor risk, refers to the potential security vulnerabilities and operational disruptions that can arise from an organization's reliance on external vendors, suppliers, or service providers. This risk materializes when these third parties, who have access to sensitive data or critical systems, experience a security breach or operational failure. Understanding and managing third-party risk is crucial because a compromise in a vendor's environment can directly impact an organization's own security posture and business continuity. For instance, a cloud service provider experiencing an outage can prevent a company from accessing its own data and applications. A common point of confusion is mistaking third-party risk solely for contractual obligations, when it fundamentally encompasses the actual security and operational capabilities of the vendor. This concept is frequently tested on certifications like Security+, CySA+, and CISSP, and is a core component of robust cybersecurity programs.