What is a Third-Party Vendor? Tips for Managing Vendor Risk

**Executive summary:** This document explains third-party and fourth-party vendor risk in cybersecurity, highlights that many breaches originate from vendor compromise, and recommends three core best practices—conducting cybersecurity risk assessments, establishing a vendor risk management framework, and continuously identifying/monitoring risks—while promoting SecurityScorecard’s real-time security ratings and Supply Chain Detection and Response for continuous vendor ecosystem visibility.