Every vendor you rely on is a risk you don't fully control. And some of the most important dependencies are companies you've never contracted with at all: the sub-vendors your vendors rely on.
Here's how to identify those risks, run a vendor risk assessment, and decide how to manage them continuously.
Why vendor risk management matters
A few reasons vendor risk management matters:
- Your vendor list is probably incomplete. Zylo's 2026 SaaS Management Index found that companies typically have 1.7× more SaaS applications than they think. Resiliate maps a median of 23 direct technology vendors per company, with some companies relying on more than 160. At that scale, a similar visibility gap would mean missing roughly 9 to 66 vendors during a risk assessment.
- Then there are the vendors behind your vendors. Your payroll provider may rely on a file-transfer service. Your CRM may depend on a cloud provider, identity platform, analytics tool, and other infrastructure. You may never have signed a contract with those companies, but their failures can still reach you. In Resiliate's dataset, the median company has 240 indirect technology dependencies, with some exceeding 600.
- Different vendors often share the same dependencies. This creates concentration risk. Across Resiliate's data, 87% of companies depend on Google in some form, while around half depend on Microsoft or AWS. What looks like a diversified vendor portfolio can still depend heavily on a handful of companies underneath it.
- The picture keeps changing. Vendors add subprocessors, change infrastructure, get acquired, and suffer incidents. A spreadsheet or annual questionnaire starts going stale as soon as it's completed.
What is an example of vendor risk?
The 2023 MOVEit breach is a good example.
Attackers linked to the Cl0p group exploited a vulnerability in MOVEit, a file-transfer tool made by Progress Software. Zellis, a UK payroll provider, used MOVEit as part of its service.
When MOVEit was compromised, data belonging to Zellis customers, including British Airways, Boots, and the BBC, was exposed.
Those companies hadn't chosen MOVEit themselves. Their relationship was with Zellis. But a vulnerability one layer further down the supply chain still reached them.
This kind of third-party exposure is becoming increasingly important. Verizon's 2026 Data Breach Investigations Report found that third parties were involved in 48% of breaches, up from 30% the previous year.
How to do a vendor risk assessment
- Map the vendor and its dependencies. Identify what the vendor provides, what business process depends on it, and what sits underneath it: cloud infrastructure, subprocessors, identity providers, payment providers, and other critical services.
- Rank it by criticality. Assess what happens if the vendor becomes unavailable. A vendor behind your checkout process deserves more scrutiny than one behind a marketing tool, even if you invest more in marketing.
- Verify what you can independently. Cross-reference what the vendor tells you with independently available information about its technology, subprocessors, incidents, and dependencies. Resiliate does this automatically, so the assessment doesn't rely entirely on the vendor's own account.
- Score likelihood and impact separately. Risk is commonly expressed as likelihood × impact. A vendor that fails frequently but causes little disruption is a different problem from one that almost never fails but would stop a critical business process when it does.
- Monitor and reassess. Don't assume the assessment stays accurate after onboarding. Vendors change, incidents happen, and new dependencies appear. Resiliate lets you follow vendors and receive alerts when something changes in your network or a disruption occurs.
Do I need vendor risk management software?
For most organisations that rely heavily on technology, yes. The problem is that manual audits based on questionnaires can become outdated almost immediately after they're completed.
A vendor can change subprocessors, move infrastructure, acquire another company, suffer an outage, or start relying on a new provider at any time.
An annual review won't catch those changes in real time.
Vendor risk management software can continuously monitor your network and notify you when something changes.
How to start monitoring vendors
Start by mapping the technology vendors your business actually depends on.
Resiliate maps your direct technology vendors and the sub-vendors behind them, automatically.
From there, follow the companies that matter most and get alerted when something changes.
Resiliate has already mapped 6,000+ companies and 90,000+ vendor relationships.
References
- Zylo, 2026 SaaS Management Index
- Verizon, 2026 Data Breach Investigations Report