Your Vendors Are Part of Your Cybersecurity Perimeter

Cyber Friday Insights

Your data does not live only in your systems. It lives in every platform, provider, and partner you trust.

This week’s Cyber Friday examples made that visible. The ShinyHunters group was reported to have taken Salesforce data from three companies in one wave: an IT services company, a medical-device business, and a medical-technology company. A small specialty-meats supplier was listed by the Play ransomware group after data exfiltration. And CISA added an authentication-bypass vulnerability in N-able N-central to its Known Exploited Vulnerabilities catalog—a reminder that one managed-service tool can connect an attacker to thousands of small-business environments.

The business lesson is simple: the vendor list is part of the security perimeter.

The deal lens

When you acquire a company, you inherit its Salesforce instance, MSP contract, backup provider, payroll platform, file-sharing tools, payment processors, and SaaS guest users. Those relationships may hold privileged access even when the target’s internal team has never reviewed the exposure as a single system.

Cyber insurance is useful, but it is not a vendor-control program. A policy does not tell you whether a provider still has an old administrator account, whether backups are isolated, whether a subcontractor can reach production, or how quickly the vendor must notify the target of a breach.

Third-party risk also becomes integration risk. A provider that cannot explain its controls may delay migration, complicate customer notification, or create an unexpected post-close dependency.

What buyers should request

Add a vendor security review to the same diligence checklist as QoE and legal:

• A complete inventory of technology, data, and operational vendors.
• The data each vendor holds and the systems each vendor can reach.
• Contract terms for security standards, breach notice, audit rights, and subcontractors.
• Current SOC reports, security questionnaires, penetration-test summaries, or equivalent evidence.
• A list of privileged accounts, service accounts, remote-access tools, and guest users.
• MFA, logging, backup-isolation, and offboarding practices for critical providers.
• Confirmation that high-risk vendors are patched and supported.
• A transition plan for vendors that will be replaced, consolidated, or re-contracted.

Rank vendors by access and business criticality, not just spend. The low-dollar MSP or SaaS tool with broad permissions may deserve more attention than the largest supplier.

Legacy Forward takeaway

Vendor risk is inherited risk. The buyer is not only purchasing revenue and contracts; the buyer is taking responsibility for the chain of access behind them.

Make the vendor map visible before signing, assign owners for the first 90 days, and price unresolved exposure into the deal plan. Diligence that stops at “do they have cyber insurance?” is not enough.

Legacy Forward Consulting helps buyers connect third-party exposure to practical close and transition decisions.

CTA: Review who already has the keys before you inherit the building.