Key Insights
- Third-party breaches are rising rapidly, making vendor cyber defenses an integral extension of a community bank's security perimeter.
- Prioritizing vendor oversight by data access and operational dependency provides clearer visibility than relying on annual spend.
- Ongoing monitoring, contractual notification terms, and vendor tabletop exercises help institutions navigate potential third-party cyber incidents.
In the weeks before Christmas 2013, attackers entered Target's network through a Pennsylvania heating and air-conditioning contractor. Attackers reportedly stole Fazio Mechanical Services’ credentials through a phishing email and used the vendor’s access to enter Target’s network. From there, the intruders reached point-of-sale systems and the payment and personal data of as many as 110 million customers.
Target had been certified compliant with card-industry security standards shortly before the intrusion, by the way. Banks and credit unions spent more than $200MM replacing 21.8 million cards within two months.
A dozen years on, the pattern has scaled. Verizon's "2026 Data Breach Investigations Report" found third-party involvement in 48% of breaches, up 60% in a single year. Black Kite's "2026 Financial Services Cybersecurity Report" documents one compromised managed service provider (MSP) that cascaded into 32 financial institutions and more than 2 terabytes of stolen data.
Four Checks for Your Vendor Perimeter
For community financial institutions (CFIs), the question is not whether to use vendors. It's whether the controls around key vendor relationships match the exposure those relationships can create. Four a are worth testing today.
1: Map Vendors by How Much Access They Have
The federal banking agencies' "Third-Party Risk Management: A Guide for Community Banks" makes it clear that not all relationships present the same level of risk. It points to third parties with access to sensitive data, those that process transactions, and those providing essential technology or business services as the relationships that warrant more rigorous oversight.
A useful inventory therefore starts from access and dependency rather than spend: who holds privileged credentials, who touches customer data, who runs a payment function, and who would be hard to replace in a week.
Black Kite’s review of 140 vendors whose client bases included at least 10% financial-sector customers shows why the distinction matters: 76 of them carry at least one vulnerability on the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities list, and 109 have a critical-level patch-management failure.
Not every vulnerable vendor comes with the same type of exposure. Determine how much a CFI needs to know about the issue, how quickly it needs to respond, and whether an alternative exists.
2: Ensure Continuous Visibility Between Reviews
Questionnaires, SOC 2 reports, and annual due diligence are point-in-time views, and vendor posture moves faster than the review cycle. Within Black Kite's 140-vendor sample, the number of vendors with critical-severity vulnerabilities grew from 15 to 73 in one year.
The Marquis Software Solutions incident shows what that gap costs. Their ransomware-susceptibility score was flagged as elevated a month before the August 2025 attack, which ultimately exposed up to 1.35 million customers across 74 or more US institutions. And the breach notification arrived more than 10 weeks after the initial intrusion.
Continuous monitoring doesn't replace due diligence or employee training. Verizon reports vulnerability exploitation has overtaken stolen credentials as the top breach entry point, at 31%. But it also found mobile social engineering succeeding 40% more often than email phishing. The controls are complementary. The point is that none of them works on a 12-month refresh.
3: Test Notice and Access Before You Need To
A vendor relationship matters most in the hours after something goes wrong, and two things shape those hours: what the contract requires and what the vendor can reach. Key contract considerations include when and how the third party will notify the bank of a disruption, and how it will help continue the activity.
Black Kite’s “2026 Third-Party Breach Report” found an average of 117 days from discovery to public disclosure in the third-party breaches it analyzed, not from discovery to notification of bank clients. Contracts should specify notification triggers and deadlines alongside applicable regulatory requirements. Covered bank service providers must notify affected bank customers as soon as possible after determining that an incident materially disrupts, or is reasonably likely to disrupt, covered services for four or more hours.
Access is the other half. The Senate’s analysis of the Target breach identified two-factor authentication for vendor access as a safeguard that could have interrupted the attack chain. Reviewing access scope, authentication, and the process for removing access keeps technical permissions aligned with what the relationship actually needs.
4: Exercise Vendor Failure, Not Just Your Own
Incident response exercises should test a critical vendor going dark, delaying communication, or reporting a breach involving customer data, not just the institution’s own outage.
A tabletop built around a named critical vendor tests the practical gaps. Who contacts the provider, who assesses operational impact, what alternate processes exist, how is access revoked, and who talks to customers and regulators about customer data held or processed by the vendor? The agency guides fold continuity planning, recovery objectives, and contingency testing into the vendor relationship itself.
The goal isn't fewer vendors. It's knowing where each critical relationship extends the institution's perimeter, and whether the controls around it have been tested under realistic conditions.
Testing Your Vendor Perimeter
Third-party relationships extend a CFI’s cyber exposure while also extending its capabilities. Start with one critical vendor, selected based on its access to sensitive data, role in payment processing, or difficulty to replace — not simply how much the institution spends.
Apply four checks: Does its risk tier reflect that access and dependency? How are changes in its security posture monitored between formal reviews? Do contracts clearly define incident-notification triggers and deadlines, and are least-privilege access and MFA in place? Has the institution rehearsed its response to that vendor’s failure, including any necessary customer notifications?
Use the findings to create a short action list, with a named owner and deadline for each gap. Assign someone to track follow-up with the vendor and verify that agreed-upon changes are completed. Then apply the same checks to the next critical relationship.
A vendor review delivers value when it leads to action. For CFI leaders, that means asking not only whether a review is complete, but what changed because of it: an access permission removed, a notification requirement clarified, or a response plan tested. Those concrete improvements turn vendor oversight from a periodic assessment into an ongoing part of protecting customers and keeping essential services running.
