Your riskiest vendor might not look like a tech company
1st October 2026Cyber risk isn't limited to just tech vendors
Ask a risk manager to name their highest cyber-risk vendors and you get the usual list: the cloud host, the payment processor, the core SaaS platform. Those get the questionnaires and the annual reviews. The janitorial service, the parts supplier, the freight company get a certificate of insurance and a short form, if anything at all.
That split is the blind spot. Cyber risk doesn't attach to an industry. It attaches to a dependency.
Take a hospital's cleaning contractor. Its crews are scheduled, badged, and dispatched through software. If ransomware takes that system down, nobody knows which rooms were turned over, which crews are on site, or who still holds working credentials to secured areas. Operating rooms can't be certified clean between procedures. Public spaces fall below sanitary standards within a shift. The hospital starts diverting patients, and by the second day it is cancelling surgeries. No patient record was ever touched. The operation stopped anyway.
Now a manufacturer whose parts supplier runs its ordering and fulfilment through a wholesale platform. The platform goes dark and the supplier can no longer see open orders, confirm quantities, or release shipments. The manufacturer's line is built on parts arriving on a schedule, not on inventory in a warehouse. By the second missed delivery the line slows. By the third it stops, and every customer downstream starts calling about their own missed dates.
What about a restaurant chain and its packaging supplier? Cups, lids, clamshells, and bags come from one vendor whose production and dispatch run on a connected plant system. That system is encrypted overnight. The plant can't run, the trucks can't be loaded, and within days hundreds of locations have no way to hand a customer their order. Takeout and delivery, often more than half the revenue, go to zero. The food is fine. The kitchens are fine. There is simply nothing to put the food in.
Each of these vendors runs systems a business depends on to function, and a failure in any of them lands on you – the business.
Many tiering models miss this because they score the wrong things: contract value, data access, whether the vendor is labeled "IT." The question that actually maps to risk is simpler. What happens to us if this vendor goes down?
And it doesn't take many. A few of the right vendors going dark at the same moment can halt an organization, no matter how well defended its own systems are.
Here's the part that rarely gets said out loud. These dependencies aren't yours alone. When that cleaning contractor goes down, it isn't only your hospital that goes dark. It's the other eleven medical facilities in the region that lean on the same vendor, all at the same time. And today, every one of them is left chasing that single vendor for recovery, competing for one pool of coverage that was never sized to make them all whole. The exposure is shared, concentrated, and almost entirely unaccounted for.
No organization operates on its own anymore. Every business is a web of other businesses, each leaning on the next, and the strength of the whole is set by the weakest system in it. Seeing that clearly, and planning for it, is the work ahead.
Disclaimer
This content is intended for general informational purposes only and does not constitute legal, regulatory, financial, or insurance advice. It should not be relied upon as a substitute for professional counsel. While efforts have been made to ensure the accuracy of the information presented, no representation or warranty is made as to its completeness or applicability to any specific situation. Readers should consult their own advisors regarding their particular circumstances.