A business can strengthen its own network, enforce multifactor authentication, patch critical systems, and still suffer a serious cyber incident through a trusted supplier. External providers may hold privileged credentials, process sensitive information, operate integrations, or provide software that sits inside important business processes.
For that reason, third-party security assessments are an important part of modern cyber risk management. The aim is not to scrutinise every supplier equally, but to identify which relationships could materially affect systems, data, or operations and apply assurance accordingly.
The UK’s National Cyber Security Centre recommends a proportionate approach based on factors such as connectivity, data exposure, supplier criticality, and potential business impact.
Start by Identifying Which Suppliers Actually Matter
Not every company on the supplier register deserves the same level of cybersecurity scrutiny.
A stationery supplier with no system access creates a very different risk from a managed IT provider with administrator credentials across endpoints, cloud services, and identity systems. Supplier assessment should therefore begin with classification rather than a universal questionnaire.
A practical approach is to group suppliers according to the impact their compromise could create:
| Supplier category | Example | Suitable assurance |
| Lower cyber risk | Office supplier with no sensitive access | Basic due diligence |
| Moderate risk | SaaS platform holding routine business information | Security questionnaire and relevant certifications |
| Sensitive data supplier | Payroll, HR, legal, or customer-data provider | Detailed security review and independent assurance |
| Privileged supplier | MSP, developer, cloud administrator | Access review, technical evidence, and stronger contractual controls |
| Business-critical supplier | Provider whose failure could halt important operations | Deep assurance, resilience review, incident planning, and ongoing monitoring |
NIST takes a similar risk-based approach in its Cybersecurity Supply Chain Risk Management guidance, encouraging organisations to gather enough information to support informed supplier decisions.
Five Questions Reveal Where Supplier Risk Really Exists
Generic supplier scores can hide the issues that matter most. A better assessment starts by understanding what the relationship actually enables.
1. What Can the Supplier Access?
Access is often the clearest indicator of supplier criticality.
An outsourced IT provider may have remote administration rights across employee devices, servers, cloud platforms, or Microsoft 365. An external developer could hold production credentials, repository access, or deployment permissions.
However, direct login access is only part of the picture. APIs, service accounts, integration tokens, VPN connections, monitoring agents, and automated synchronisation can also create trusted pathways.
Businesses should map both the permissions granted and the systems reachable through those permissions. Credentials that can reach identity, backups, or critical infrastructure deserve stronger controls than access limited to one application.
2. What Information Does the Supplier Hold?
Some high-risk suppliers never connect directly to the organisation’s network.
A payroll provider may hold employee addresses, salaries, tax information, and bank details. A legal platform might store privileged documents, while a CRM may contain years of customer records and correspondence.
Businesses should therefore evaluate information exposure separately from network connectivity.
Important questions include what data the supplier receives, where it stores that information, how long it retains it, which subcontractors can access it, and how the information is deleted when no longer required.
3. What Happens If the Supplier Becomes Unavailable?
Cybersecurity is not only about preventing data theft.
Availability can be equally important when a business depends heavily on one provider for essential operations.
A logistics company may rely on a cloud platform for every dispatch. If ransomware makes that platform unavailable for several days, the disruption can be severe even if no customer information is stolen.
The same concern applies to payroll, payment processing, booking systems, identity platforms, and other operational services. High-risk reviews should therefore consider backup arrangements, recovery capabilities, alternative processes, and incident communication.
4. Can the Supplier Change Something Important?
A supplier that can modify systems creates a different kind of trust.
Developers may deploy production code. Managed service providers can alter firewall rules. Website agencies may install plugins or scripts. Cloud consultants might create privileged identities or modify infrastructure.
The SolarWinds incident demonstrated why trusted technology requires scrutiny. CISA reported active exploitation involving compromised SolarWinds Orion software, showing how widely trusted software could become an attack route.
The broader lesson is straightforward: suppliers that can push code, configuration, updates, or privileged changes into your environment deserve stronger assurance.
5. Who Does Your Supplier Depend On?
Your supplier may only represent the first layer of a longer chain.
A SaaS provider could depend on a cloud hosting company, identity platform, external development team, analytics provider, support contractor, and backup service.
NIST includes supply chain tiers within its due-diligence guidance for this reason.
Investigating every subcontractor is rarely practical, so focus on dependencies that could materially affect data security, service availability, privileged access, or business continuity.
Questionnaires Should Lead to Evidence
Security questionnaires remain useful because they establish a baseline.
They can show whether a supplier claims to use MFA, conduct penetration testing, maintain backups, manage vulnerabilities, secure privileged accounts, and operate an incident response process.
However, a positive answer does not prove that the underlying control works.
For example, a supplier may say that MFA is enabled without explaining whether privileged administrator accounts are covered. Another provider might confirm annual penetration testing even though the assessment excluded the service your organisation actually uses.
The NCSC warns against treating supplier assurance as a box-ticking exercise. Evidence requirements should instead reflect the importance of the relationship.
Its Supplier Assurance Questions provide a useful starting point across governance, incident response, data protection, network security, personnel controls, independent testing, and contracts.
What Should You Ask a High-Risk Supplier to Prove?
For higher-risk providers, useful assurance may cover:
- Independent testing: Recent penetration testing or other independent technical security assessment evidence.
- Remediation status: Confirmation that critical and high-risk findings were addressed.
- Privileged access: Evidence of MFA, least privilege, and strong administrator controls.
- Incident response: Clear breach notification, escalation, investigation, and communication procedures.
- Recovery capability: Tested backups, restoration arrangements, and business continuity measures.
- Data and supply chain: Clarity about data locations, subcontractors, and access controls.
Even so, organisations should not automatically demand a full penetration-test report. Detailed reports can contain sensitive architecture, vulnerability, and system information.
In many cases, an executive summary, testing date, scope description, remediation confirmation, assessor details, certification evidence, or controlled review can provide sufficient assurance.
Where VAPT Fits into Third-Party Security
Supplier assurance and VAPT overlap, but they solve different problems.
You cannot penetration test a supplier’s infrastructure simply because they provide a service to your business. Security testing requires explicit authorisation from the owner of those systems.
However, there is often plenty to test within your own environment.
Assess Supplier Remote Access
External IT providers frequently connect through VPNs, RDP, remote management software, or privileged support accounts.
A VAPT assessment can determine whether those accounts use MFA, whether privileges are appropriately restricted, whether inactive access remains enabled, and whether segmentation limits further movement.
Where suppliers depend heavily on remote connectivity, our guide to remote access VAPT explains these attack paths in greater depth.
Review APIs and Integrations
Supplier relationships increasingly operate through automated connections.
Payment platforms exchange transaction information. CRMs synchronise customer data. HR systems connect with identity providers. Logistics services automatically receive delivery information.
A security assessment can identify overprivileged API keys, insecure authentication, exposed secrets, weak authorisation, or outdated integrations that provide more access than the supplier actually requires.
Where APIs form an important part of the relationship, API VAPT can test these controls in greater depth.
Measure the Blast Radius of Supplier Compromise
A useful internal question is:
“If this supplier is compromised, how much damage can the attacker cause inside our environment?”
Imagine that an MSP administrator account is stolen. Could the attacker disable endpoint security, access backups, create privileged users, reach sensitive databases, or control every workstation?
Least privilege, segmentation, separate administrator identities, access restrictions, and monitoring can reduce that impact.
Verify That Access Still Matches Business Need
Supplier permissions often expand gradually.
A provider may initially need only names and email addresses. Several years later, the same integration token might be capable of accessing complete customer profiles because systems evolved while permissions remained unchanged.
Periodic assessment should compare current access against the supplier’s actual purpose and remove anything no longer required.
Real Incidents Show Why Supply Chain Risk Matters
Third-party cyber risk is not theoretical.
The SolarWinds incident demonstrated the consequences of compromising technology already trusted by customer environments. A different pattern appeared with MOVEit Transfer in 2023, when attackers exploited a zero-day vulnerability in widely deployed third-party software to access information from affected systems.
The incidents were technically different, but both demonstrate the same business problem: organisations can face serious exposure through technology they did not develop and infrastructure they do not fully control.
Supplier assessment should therefore consider both the provider’s security posture and the level of dependency the relationship creates.
Put Security Requirements into the Contract Early
The worst time to negotiate security responsibilities is immediately after a breach.
Before entering a high-risk supplier relationship, businesses should establish what happens when something goes wrong.
Relevant questions include:
- How quickly must the supplier notify you of an incident?
- What information must the notification contain?
- Will the supplier cooperate with your investigation?
- Can subcontractors be appointed without notification?
- Who is responsible for preserving incident evidence?
- What happens to your data when the contract ends?
- Do you have appropriate assurance or audit rights?
- Must the supplier maintain specific security controls?
The NCSC’s supplier guidance encourages organisations to consider ongoing assurance, incident management, secure contract exit, and appropriate audit rights.
Addressing these points during procurement is usually far easier than trying to add them after a problem occurs.
Reassess Suppliers as the Relationship Changes
Supplier risk is not static.
A platform that once stored only employee email addresses may eventually hold customer data, confidential documents, API credentials, and SSO integrations.
Reassessment may be appropriate when:
- Sensitive data volumes increase
- Privileged access expands
- New APIs or integrations are introduced
- Network connectivity changes
- The service becomes business-critical
- Major architectural changes occur
- A serious vulnerability affects the supplier
- The provider experiences a security incident
- Contract renewal creates a natural review point
Regular reassessment keeps supplier assurance aligned with the current relationship rather than the relationship that existed when procurement first approved it.
Final Thoughts
Third-party security assessment should help businesses decide where trust needs stronger verification. Identify which suppliers can reach critical systems, determine who handles sensitive information, understand operational dependencies, and ask for evidence that matches the potential impact.
Aegixis VAPT Services can help organisations assess the technical exposure created by supplier remote access, privileged accounts, APIs, and other third-party integrations. Where testing is properly authorised, Aegixis can identify attack paths, explain their business impact, and provide practical remediation guidance to reduce supplier-related exposure.
