The vendor risk question nobody asks

Most vendor risk management is a checkbox exercise. The vendor sends a SOC 2 report, the buyer files it, and everyone moves on. The report is not the question.

The question

"What is the blast radius if you are compromised?" In other words, what data of mine do you hold, what access to my systems do you have, and what would an attacker do with the worst-case combination of both?

Why this matters

The biggest breaches of the last decade involved third parties. The customer's defenses were fine. The vendor was the entry point.

What to do with the answer

• Limit standing access. If a vendor only needs access during certain operations, give it to them then.
• Segment vendor connections at the network level.
• Audit logs from vendor activity, ideally piped into your SIEM.
• Have an exit plan. What does it look like to cut a vendor off in a hurry?