B BROCENT

third-party risk

Cover image for Brocent IT blog post: Your IT Provider Is Part of Your Attack Surface: Third-Party Cyber Risk From Both Sides of the Contract

October 13, 2026 | 23 min

Your IT Provider Is Part of Your Attack Surface: Third-Party Cyber Risk From Both Sides of the Contract

A research report on third-party cyber risk when the third party is your IT provider. It sets out what the joint CISA/NSA/FBI advisory AA22-131A tells buyers and providers to do, what Verizon's 2026 Data Breach Investigations Report measures about third-party involvement in breaches, how the US SEC disclosure rules raise the stakes for notification terms, and what a buyer should put in the contract rather than the questionnaire. Observations about buyer questions in Hong Kong and Singapore are Brocent's own and are labelled as such.