Third-party risk management, or TPRM, is the process of identifying, assessing, contracting, monitoring, and terminating suppliers and partners while considering the risk each brings to the company. In information security, the central question is what an attacker could do through a supplier.
Vendors often have remote access, service credentials, system integrations, and copies of data, without always maintaining the level of protection the hiring company requires of itself.
Why vendors become part of the attack surface
Attacking a well-protected company directly is expensive. Attacking a service provider that has access to it is usually cheaper. In tests for the 2026 Cyber Risk Landscape, a Vultus study of 132 organizations, it was possible to reach the VPN from scratch in 23.8% of cases, and credentials stolen by infostealers accelerated intrusion in 21.4%.
Some of this access belongs to third parties, who enter the network with legitimate credentials.
International reports confirm the importance of this vector. In M-Trends 2026, from Google Cloud, third-party compromise accounted for 17% of cloud environment intrusions, and the Global Cybersecurity Outlook 2026, from the World Economic Forum, cites dependence on critical vendors among organizations' growing concerns.
The seven stages of the third-party lifecycle
The Vultus methodology assesses the process end to end, across seven stages and 54 reference deliverables. Identification and classification establish which service the vendor provides, which data and systems it will access, and how critical it is. The preliminary assessment brings together a questionnaire, evidence of controls, and a technical opinion. Due diligence formalizes risk acceptance and the action plan.
Contracting includes security clauses, incident notification deadlines, audit rights, and least-privilege access. This is followed by continuous monitoring with reassessments, governance through a committee and metrics, and offboarding, with access revocation and data return or destruction.
Where processes usually fail
Patterns repeat across industries. Vendors are classified by purchasing category rather than service: a low-risk consultancy given administrative access to the ERP remains classified as low risk. The same questionnaire is sent to the coffee supplier and the company hosting customer data.
Legal uses the standard contract without knowing what the technical assessment found. Reassessment happens only at renewal. No authority can block a high-risk vendor. And ending the contract does not terminate access.
Where to start
Organizations without a TPRM process can begin in stages:
- Inventory: who the suppliers are and what access each has today.
- Critical asset classification: priority for those accessing sensitive data or systems that support operations.
- Offboarding: the least expensive stage to fix and the one that leaves the most access open.
- Risk in the contract: what the assessment found becomes a contractual clause.
- Decision-making authority: a committee with authority to block contracts involving unmitigated risk.
Regulated sectors have specific requirements. Institutions supervised by the Central Bank of Brazil face requirements for procuring processing and cloud services, and the LGPD holds companies accountable for data processed by their contractors.
TPRM integrated with security
Vultus structures the third-party lifecycle with classification based on service scope, reassessment independent of contract renewal, and governance with decision-making authority. Explore Vultus third-party risk management and read about LGPD compliance.
