Most third-party risk programs don’t fail because of a bad tool or a lazy team. They fail
because of assumptions nobody questions.
We see it again and again, across industries and across audit, risk and TPRM teams. One
small assumption gets baked into the process, and a whole group of vendors quietly falls
through the cracks. Here’s the one we come across most often.
The Vendors That Don’t Fit The Template
A lot of TPRM programs are built around vendors that can hand you security
documentation. ISO certificates, SOC 2 reports, policies, procedures, you name it. The
process works well for them because there’s something to review.
But every company also works with what we call atypical vendors. A one-person agency.
A freelance specialist. A small supplier in an industry where certifications just aren’t a
thing. Think of a recruitment agency. Nobody expects them to show up with a SOC 2
report.
So what happens with these vendors? Usually one of two things.
- “We can’t assess them, they have no certifications.”
- “They’re too small, so they’re probably low risk.”
And then we do nothing. Or close to nothing. We’re happy with a copy of their liability
insurance, maybe a cyber insurance policy. If we do send a questionnaire, we accept the
answers as they are and never ask for supporting evidence.
Small Vendor, Big Data
Here’s the problem. The size of the vendor tells you nothing about the sensitivity of the
data they handle.
Say you’re a biotech company and you hire a one-person research consultancy. That
person is working with your confidential research. Where does it live? On their laptop. Is it
encrypted? Backed up? Shared with anyone else? You don’t know, because nobody asked
Assumptions can kill your third-party risk program for proof.
Or take the recruitment agency. If they’re helping you find your next CFO or CEO, they’re
sitting on some of the most sensitive and time-critical information your company has. A
leak there isn’t a small incident just because the agency is small.
So these vendors need proper due diligence too. Not a lighter version because they’re
inconvenient to assess.
Not Once, All The Time
And it’s not a one-time thing. A small vendor can change a lot in a year. They take on a
subcontractor, switch tools, get breached, or start handling more of your data than when
you onboarded them. A check at onboarding and then silence is just another assumption.
How We’re Tackling This at 3rdComply
This is exactly why 3rdComply doesn’t rely on documentation alone. We combine multiple
sources to build a real picture of each vendor.
- The documents they do have
- Public news about the vendor
- Dark web monitoring
- A scan of the vendor’s website
But for vendors with little or no documentation, that’s still not enough. So we’re building
an AI audit bot that companies can use to assess these kinds of vendors at scale, without
flying an auditor out to sit next to them and observe.
The bot runs online. It collects information from the vendor through voice, video, and
photos, on top of the document processing we already do. The vendor can show how they
actually work instead of just ticking boxes.
The goal is simple. Every vendor gets assessed with the same rigor, or close to it, whether
they’re a global SaaS provider or a one-person shop.
Curious?
If you’re sitting on a long list of vendors without mature security artifacts and you’re not
sure what to do with them, we’d love to hear how you’re handling it today. And if you want
to try what we’re building, just let us know at 3rdcomply.com