CyberGuard dictionary / Business Cybersecurity
Vendor Risk
Vendor risk is the exposure created when a supplier's products, services, or practices can harm a customer's security or continuity.
In simple terms
Buying a tool or outsourcing a task can add useful capability while also adding a dependency.
Technical explanation
A vendor review should match the service's sensitivity and may examine data access, security controls, support, subcontractors, recovery, and exit arrangements. A questionnaire alone is not proof that controls operate effectively.
Risk comes from what a vendor can access and how failure of its service would affect the business. Reviews should be proportionate to that exposure and revisited when access or scope changes.
Examples in practice
Before giving a support vendor production access, a company checks the vendor's access process, logging, and ability to revoke accounts.
A vendor first receives only test data, then requests production administrator access. The customer performs a new review, narrows the permission, and records the approval and revocation plan.
Why it matters
Knowing the dependency helps the business set conditions and prepare for supplier failure.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.