Glossary · T
Third-party risk
Third-party risk is the exposure an organization carries through the vendors, partners and service providers that access its systems, hold its data or deliver its critical services.
Extended definition
In more detail.
Most organizations depend on dozens of third parties, and many breaches arrive through one of them. Managing the risk means knowing which vendors matter, assessing them in proportion to consequence, obtaining agreements and evidence, and reviewing them as terms and services change. Customers and regulators increasingly ask how vendors are governed, and AI features inside existing vendors have become a common gap.
In our work
Where it appears.
See third-party risk reviews and, for AI vendors, AI vendor and model risk review.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days