{"id":15515,"date":"2026-01-21T07:08:14","date_gmt":"2026-01-21T07:08:14","guid":{"rendered":"https:\/\/newestek.com\/?p=15515"},"modified":"2026-01-21T07:08:14","modified_gmt":"2026-01-21T07:08:14","slug":"13-cyber-questions-to-better-vet-it-vendors-and-reduce-third-party-risk","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=15515","title":{"rendered":"13 cyber questions to better vet IT vendors and reduce third-party risk"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

Increased reliance on IT service providers, digital tools, and third-party software is greatly expanding the enterprise attack surface, with noteworthy cyberattacks over the past year underscoring this fact.\u00a0<\/p>\n

In October 2025, Marks & Spencer terminated its longtime helpdesk deal with outsourcing giant Tata Consultancy Services following a cyberattack that cost the British retailer <\/strong>an estimated \u00a3300 million and temporarily shut down its online business.<\/a><\/p>\n

In August, a Chinese threat group leveraged compromised OAuth tokens<\/a> from third-party platform Salesloft Drift to exfiltrate sensitive business data\u00a0\u2014 AWS keys, Snowflake tokens, passwords \u2014 from as many as 700 organizations. This came on the heels of a wave of attacks in which cybercriminal gang ShinyHunters pretended to be IT support personnel<\/a> to trick users into connecting to malicious versions of Salesforce\u2019s Data Loader, which was then used to exfiltrate data from Salesforce environments. All told, 1.5 billion Salesforce records<\/a> were claimed to have been stolen.<\/p>\n

And, back in April, a critical zero-day vulnerability<\/a> in SAP NetWeaver, one of the most widespread incidents involving an ERP platform, illustrated that enterprise software has become a prime target for attackers because their compromise directly impacts the revenue, operations, and reputation of an organization.<\/p>\n

\u201cAdversaries continue to exploit the path of least resistance, increasingly targeting third-party providers and human vulnerabilities to bypass technical controls,\u201d says Casey Corcoran, field CISO at Stratascale, the cybersecurity division of SHI International. \u201cBy compromising trusted vendors, attackers can move undetected for longer periods, exploiting established access points across multiple organizations.\u201d<\/p>\n

Because these are newer avenues for attack, companies have been caught on their heels. \u201cWe don\u2019t have enough preparation or defensive tools to rapidly detect and defend against these attacks, leading to a significant level of risk for lots of companies,\u201d says Joshua Wright<\/a>, faculty fellow of the\u00a0SANS Institute\u00a0and technical director at Cyber Hack Challenges.<\/p>\n

John Alford<\/a>, CSO at TeraType, an adviser to pharmaceutical, financial, and SaaS firms on cybersecurity, compliance, audit and AI governance, says legacy mindsets are also to blame.<\/p>\n

\u201cMany organizations still defend their environments as if threats march up to the front gate when in reality the most effective attackers slip in through the service corridors that nobody monitors,\u201d Alford says. \u201cThe Marks & Spencer situation proved this: A help desk workflow became a quiet passage into production because it relied on trust by default.\u201d There appeared to be no strong caller verification processes, no step-up checks, and no guardrails on what support staff could change, he adds.<\/p>\n

The Salesforce ecosystem breaches demonstrate another common blind spot: Once attackers capture a token or exploit a permissive integration, they gain the full authority of a trusted insider. \u201cCompanies that rely on perimeter controls and MFA alone never see this risk because they are not watching the right places,\u201d Alford says.<\/p>\n

The CSO\u2019s role in vetting IT vendors<\/h2>\n

Cyber obligations are already written into IT services and SaaS contracts, but \u201cthere are limits to what companies can do,\u201d says Stephen Lilley<\/a>, partner at law firm Mayer Brown. \u201cCompanies are unlikely to be able to impose cyber requirements that go beyond what is commonly seen in the relevant market. And even sophisticated companies still experience cyber incidents \u2014 meaning that IT providers, like their customers, are unable to entirely eliminate the risk from these attacks.\u201d<\/p>\n

Although risk eradication is not possible, better mitigation is. Here, CSOs can play a crucial role.<\/p>\n

\u201cCSOs are uniquely able to see across the full business process \u2014 data flows, dependencies, and downstream impact\u00a0\u2014 but many organizations still don\u2019t use that perspective to reassess third-party risk as reliance grows,\u201d says Randy Gross<\/a>, CISO for CompTIA. \u201cCross-functional collaboration is a core CSO imperative: partnering early with procurement, legal, IT, and business leaders so security, resilience, and exit risk are designed in, not bolted on.\u201d<\/p>\n

When engagements are initiated at the business-unit level or come in below financial approval thresholds, CSOs may not even be aware of them.<\/p>\n

\u201cIn many organizations, security leaders are brought in only after a contract is executed or \u2014 worse \u2014 after a security issue arises,\u201d says Melissa Ventrone<\/a>, leader of law firm Clark Hill\u2019s cybersecurity, data protection, and privacy practice. \u201cThey should be involved \u2026 [and] their involvement does not need to slow the contracting process.\u201d<\/p>\n

In fact, CSOs can act as a \u201cpragmatic technology advisor\u201d says CompTIA\u2019s Gross, seeking critical information they are uniquely qualified to assess.<\/p>\n

Vital vendor questions CISOs should ask<\/h2>\n

To gain that critical information, security leaders and experts recommend CSOs ask IT partners the following cyber-specific questions.<\/p>\n

1. What attestation will you provide to prove proper security controls are in place?<\/h3>\n

These are essential, says Juan Pablo Perez-Etchegoyen<\/a>, CTO for cybersecurity and compliance platform Onapsis. Some of the most commonly used include:<\/p>\n