Vendor security covers risks introduced by suppliers, including software flaws, exposed systems, and weak access to customer data.
Search across headline titles and summaries.
Background for this topic.
Vendor is an external organization that supplies an IT product or service, such as software, hardware, cloud hosting, or managed security. In security reporting, the term usually concerns a third party whose technology, personnel, or connectivity forms part of an organization’s environment or handles its data.
Vendor risk depends on the access and dependency involved. A compromised or poorly secured vendor can expose customer information, introduce vulnerabilities through software updates or components, or provide attackers with a route into connected systems. Practical controls include risk-based due diligence, contractual security and notification requirements, least-privilege access, vulnerability and software-supply-chain review, monitoring, and prompt removal of access when a relationship ends. Assessments should also address privacy obligations and how the vendor will support investigation and recovery if a security incident occurs.
Panelists Discuss Deepfake, Trust Frameworks, AI Skepticism, Venture Capital WoesFrom RSAC Conference 2025 in San Francisco, ISMG editors wrapped up coverage discussing the impact of U.S. government funding cutbacks, growing deepfake threats, trust challenges in AI adoption and venture capital pressures affecting the cybersecurity vendor market.
Blackpoint Cyber's Manoj Srivastava on Orchestration, Context and Unified CybersecurityThe traditional notion of a fixed security perimeter has become obsolete, and the threat surface has expanded significantly due to remote work, cloud adoption, IoT devices and third-party vendor integrations, said Manoj Srivastava, chief technology and product officer at Blackpoint Cyber.