Concentration Risk and the Vendors You Never Chose

The Vendors You Never Chose

You signed a contract with your vendor. You never signed one with your vendor's vendor. That gap is where most supply chain pain actually lives.

In the latest episode of the Third Party podcast, Jeffrey Wheatman, Bob Maley, and Ferhat Dikbiyik take apart the two risks almost nobody budgets for.

The definitions are not complicated:

• Concentration risk is the eggs and baskets problem. One critical service, one vendor, no fallback. Drop the basket and every egg breaks.
• Cascading risk is a relay race. The first runner drops the baton and the fourth runner never finishes. You are the fourth runner.

Here’s an example. A hospitality CRM platform suffered a breach a few years back, exposing guest data from hotels and restaurants that used it. The platform itself was not the entry point. Its own data transfer agent was. Nobody whose data was exposed had agreed to do business with the CRM, let alone with a company two steps further down the chain.

Your Ecosystem Is a Mesh, Not an Org Chart

The single biggest mistake in TPCRM is drawing your ecosystem as a tree. Third party, fourth party, fifth party. The vocabulary implies a tidy hierarchy flowing downward.

It does not work that way. Your fourth party is frequently also your third party. Your third parties quietly share each other's suppliers. The real shape is a mesh.

So stop trying to score it. Visualize instead. If you know a vulnerability is being actively exploited, and you know which of your vendors sit behind the same provider, you can act on that today. That is the whole argument for Nth-party visibility, and for turning global threat activity into ecosystem-specific risk intelligence you can prioritize against.

The traditional answer was to pass the buck. Sub-processor clauses, notification requirements, a paper trail. Your vendor emails you that two new sub-processors now touch your data. They have met their contractual obligation. The email goes in a folder, nothing happens, and everyone moves on because everyone is busy. Downstream liability does not play well in a courtroom either. When your data is gone, nobody wants to hear whose fault it was three hops away.

The Blast Radius Keeps Widening

The Black Kite Research Group™ found the average number of organizations affected per third-party breach sat just above three in 2023. By 2025 it reached 5.28.

Treat that as a floor, not a ceiling. Many disclosed breaches never get attributed to a third party because the victim never worked out that is what happened. Roughly 26,000 additional companies may have been swept into these incidents without ever being named. The true figure could be several times higher.

Scale it and the arithmetic turns especially ugly. Five organizations per breach, each with their own five, compounds through every tier of the mesh.

One example makes it concrete. In a single region, one provider handles SWIFT connectivity for every financial institution doing business there. That provider employs ten people. Ten. A breach or an outage there reaches at least 50 banks and millions of their customers, none of whom chose that vendor. And there will be more of them. AI has made it cheap to run a company with two or three people, including the ones holding up a critical service.

Most Resilience Planning Is Theater

Do your resiliency tabletop exercises include your vendors? The answer is almost always no. That means you rehearsed a crisis in which every vendor held up, which is not the crisis you are going to get. 

The crisis you get is simpler than that. A vendor stops working, and so do you. It does not even take an attack. CrowdStrike was never a breach. It was an operational failure inside a security vendor that took other companies down with it. At a dinner shortly afterward, a room of practitioners agreed they all ask vendors whether they have MDR. Not one had asked which MDR. Same cloud, same agent, same single point of failure, invisible on every questionnaire anyone had sent.

Ransomware sharpens this further. The lower mid-market is now the preferred target, and business interruption drives payment faster than data theft ever did. If you cannot operate, you cannot earn, and attackers know it. That is before you account for ransomware crews claiming fully automated operations, discovery through negotiation to payment, with no human in the loop.

Regulators will likely force visibility here before buyers demand it. Nobody assessed third parties until regulators told banks to. Nobody ran continuous monitoring until it became a requirement. DORA is already identifying providers critical to the financial sector and building a repository of them. Expect concentration risk to be defined at the industry level first, then pushed down to individual firms.

How to Raise This With Leadership

Do not walk into a board meeting with a mesh diagram. Complexity for its own sake is a career limiting move.

Work through your CEO first and arrive with a decision to make, not a picture to admire. Six or seven slides in the deck, forty in the appendix. Drop the vocabulary too. "Cascading risk" means nothing to a director. "We depend on vendors who depend on other vendors" lands instantly, and so does "downstream liability."

Then do the homework. Ask every critical vendor one question: name three suppliers who, if they went down, would stop you from delivering the product or service we pay you for. Those answers will teach you more than the next hundred questionnaires, and they cost nothing but an email.

A vendor too big to negotiate with is still too important to leave unmapped. You may have no leverage over them. You can still know exactly where they sit, and what breaks when they do.

Don't Miss an Episode!

Subscribe to Third Party on YouTube, the podcast for people who don't need to ask ChatGPT what TPCRM means. New episodes every other week.

Next time on Third Party:

Next episode, we're talking about where Black Kite fits in the evolution of the exposure markets. These markets are moving fast, and the category lines are blurring. We sort through what matters and what's just analyst noise.

Subscribe below.