Ask your leadership team: how many of your vendors could stop your business tomorrow? The first answer usually lands on three or four names: the hosting provider, the business software, maybe the IT provider. It is almost always wrong, and not because a few names are missing. It is wrong because the vendor that can stop you is often not on the list of the ones you pay.
This fall showed it more than once. Most of the organizations that had to notify customers, suspend operations or wait for someone else's recovery had not been attacked themselves. They depended on a link they could not see, or one they shared with everyone else.
The provider your whole sector shares
On September 20, ransomware hit Data Hub, the data centre that hosts the servers of 72 of the 90 brokerage firms listed on the Nepal Stock Exchange. Trading was suspended for a full day on September 21 and resumed on the 22nd. Status: reported by the Nepali press. As we explained in our piece on three incidents that came through a provider, no broker was targeted on its own. Each had chosen the same provider, one by one, for good cost reasons.
That is concentration risk in its purest form. Guideline B-10 from the Office of the Superintendent of Financial Institutions (OSFI) describes two kinds. One is specific to an organization: the risk of loss or harm from overreliance on a single third party. The other is systemic: one third party, or one geography, providing services to many institutions. B-10 applies to federally regulated financial institutions, but the logic holds for any organization. The question is not only "is this vendor reliable?" but "who else depends on it, and what happens if everyone loses it on the same day?"
What it changes: a vendor can be solid, well rated and well run, and still be your biggest risk, simply because you cannot do without it, and neither can your competitors, your customers or your other vendors.
Your vendor's vendor
The second kind is quieter. In September, Master of Malt had to tell customers that their contact details were in attackers' hands. Master of Malt had not been hacked: its store runs on BigCommerce, and two apps installed on the platform held an API key that the attackers used. BigCommerce confirmed the compromise. The same week, Cooksongold asked customers to replace their payment cards after unauthorized access at the provider that handles its card authentication. Status: confirmed by the companies.
In both cases, the chain had at least one more link than the third-party register knew about. An app added from a SaaS marketplace almost never shows up as a vendor. Neither does an e-commerce provider's payment provider. B-10 accounts for this: it defines a subcontractor as an entity within the third party's supply chain, and asks institutions to assess concentration across several dimensions, including geography, supplier and subcontractor.
The FBI case in early October adds a nuance. The Bureau confirmed that an intrusion into a platform run by a third party came from a published patch the contractor never applied, and removed the contractor. Status: confirmed by the FBI; the contractor's name is only reported by Reuters. We covered it in our piece on security tools: you can outsource running a platform, not accountability for what happens on it.
The dependencies you never chose
The third kind does not even appear in contracts. In late August, Quebec's construction commission (CCQ) shut its online and phone services for fifteen days after a cyberattack. Employers and workers across an entire industry relied on it for competency cards, hours and insurance. None of them had chosen it as a vendor. We drew five continuity lessons from it, including this one: a third-party register that only lists the companies you pay misses the bodies, sector platforms and mandatory registries that stop you when they stop.
Large providers are not immune either. In July, a threat actor claimed to have stolen source code and access tokens from Accenture; the company confirmed a limited incident. Status: theft claimed, incident confirmed. The point is not to single out one provider, but to note that the more clients a provider serves, the more of them an incident reaches at once.
The cost follows. According to IBM's 2026 Cost of a Data Breach report, supply chain compromise is the factor that adds the most to the bill in Canada, roughly $367,900 per incident, for an average cost of $7.11 million. Status: reported.
The method: map your critical dependencies in four steps
The NIST Cybersecurity Framework 2.0, published in February 2024, made the supply chain a category of its own under the Govern function. One of its outcomes fits on a line: suppliers are known and prioritized by criticality (GV.SC-04). Easy to write, hard to do. Here is a method that fits in half a day.
1. Start from processes, not from the vendor list. Take the processes that would stop the business, the ones you named when writing your first ten risk scenarios: billing, producing, shipping, paying, serving customers. For each, one question: which third parties does this process need to run tomorrow morning?
2. Count the ones you don't pay, too. Add the apps installed in your SaaS tools, the integrations that hold an API key or delegated access, the mandatory bodies and sector platforms, the payment provider, the identity provider. For each, note what it can read or change in your environment.
3. Go one level down, once. For your five to ten most critical third parties, ask what they depend on themselves: where are they hosted, who processes their payments, who runs their data centre? You are not looking for completeness, you are looking for common points: the same host behind three of your vendors, the same data centre as half your sector. Those are your concentrations.
4. For each concentration, write three things. The degraded mode: how the business runs for a day, then a week, without that third party. The exit plan: B-10 asks for stressed and non-stressed exit plans for critical arrangements, and the NIST CSF covers what happens when a relationship ends (GV.SC-10). And the notification clause: within how many hours does that third party tell you about an incident, including one at its own subcontractors?
What it changes: the list that comes out of this exercise is short, and that is the point. It does not replace your third-party register; it tells you which vendors deserve continuous monitoring rather than an annual questionnaire. The NIST CSF says so explicitly: supplier risks are understood, prioritized and monitored over the course of the relationship (GV.SC-07), not only at signature.
This week's test: thirty minutes, one question
Bring together the finance lead, the operations lead and the IT lead. Ask the opening question: how many of our vendors could stop our business tomorrow?
- Each person writes their own list, alone, in five minutes.
- Compare the three lists. Note the names that appear on only one.
- For each name you keep, answer: who else in our sector depends on it? And what does it depend on itself?
- Count the third parties for which you have a written degraded mode.
Three results should worry you. Three very different lists: nobody shares the same view of your dependencies, so nobody manages them. No name you don't pay: you are missing the apps, bodies and platforms that can stop you without a contract. Zero written degraded modes: the day that third party goes down, you will improvise.
What you should have in two weeks
One page. Your critical dependencies, five to fifteen lines, each with the process it supports, what it holds in your environment, its own main dependencies, and a "degraded mode" column with its gaps in plain sight. In the margin, your concentrations: the third parties you share with your sector, and the subcontractors that show up behind several of your vendors.
Where FortaRisks fits
To start without a platform, our free vendor security questionnaire builds a questionnaire tailored to each third party, subcontractors, data location and incident notification included, and exports it to CSV. To see where your program stands, the vendor risk readiness check gives you a maturity reading in a few minutes.
To monitor the third parties that can stop you, including the ones you never chose, Forta Suppliers continuously cross-checks each vendor's questionnaire against an external scan of its real attack surface: the gap between what it declares and what is observed becomes an explicit signal, with a first alert within 48 hours, rather than at the pace of an annual campaign. The vocabulary is in our entry on third-party risk management.
Sources: OSFI, Guideline B-10, Third-Party Risk Management · NIST, Cybersecurity Framework 2.0 (CSWP 29, February 26, 2024) · Nepal News, the Nepal Stock Exchange and Data Hub · BleepingComputer, BigCommerce and the Ribon apps · Cooksongold, data breach notice · The Hacker News, the FBI and the contractor · CCQ, services restored · Benefits and Pensions Monitor, IBM 2026 report for Canada