Security Is Last to Know About New Vendors. Here's How to Fix That.
Security is often last to know about new vendors. See how to operationalize third-party risk management before contracts are signed, not after.
Summary
In a recent CSO Online column, CISO Greg Neville argues that most organizations handle third-party risk through last-minute heroics instead of a repeatable process. His central complaint: "Security is always last to know" about new vendors. By the time a vendor reaches security review, the business has already chosen it and the contract is nearly done. That leaves security as a gatekeeper with no leverage.
Neville calls for a real operating model. That means a defined intake process, clear timelines, early involvement from legal, finance and procurement, and contracts that hold vendors to their security commitments. He also flags AI as an accelerant: employees are putting sensitive data into unapproved AI tools before anyone has assessed them. That makes a defined AI vendor review process urgent.
The InfoSight take: regulators already expect the process, not the heroics.
For InfoSight's core industries, third-party risk isn't optional:
Financial institutions operate under the federal banking agencies' Interagency Guidance on Third-Party Relationships, which expects risk management across the full vendor lifecycle.
Healthcare organizations are responsible for how business associates protect patient data, and vendor breaches remain a leading source of healthcare data exposure.
Manufacturers depend on suppliers, integrators and remote-access vendors, and each of them can be a path into production systems.
Proof beats assumption. Here's how InfoSight helps:
Vendor risk assessments. InfoSight evaluates your vendors' security posture before contracts are signed, so risk decisions happen while you still have leverage.
Mitigator® gives you continuous risk visibility, so your view of vendor exposure stays current after onboarding.
24/7 SOC monitoring, Powered by AI, Fueled by Experts. Vendor access and third-party connections are watched around the clock, so unusual activity through a trusted partner gets caught and investigated.
Do you know which of your vendors could put you at risk today?
Stay ahead of evolving threats with expert insights
Subscribe to our newsletter to keep you updated on the latest cybersecurity insights & resources.
One follow-up from a security expert—no spam, ever.