Continuous third-party risk monitoring: why a one-time vendor review isn't enough

The process is almost universal: before signing with a new vendor, someone sends a security questionnaire, asks for a certification, maybe reviews an audit report. The answer comes back, gets filed away, and the contract gets signed. From that point on, for nearly every company, that vendor's security posture never gets revisited again — it becomes a static data point about a relationship that is, in practice, anything but static.

The problem is that third-party risk doesn't freeze on signing day. A vendor can get acquired, lose its security leadership, let a certification lapse without renewing it, bring on a subcontractor nobody approved, or simply suffer an incident that only surfaces months later. None of that shows up in a questionnaire filed away two years ago.

A security questionnaire is a photo, not a movie

An onboarding security assessment captures a vendor's posture at one specific moment — and only that moment. A certification valid today can expire in eight months without anyone downstream noticing. A strong security team today can be dismantled in a reorganization tomorrow. Treating that snapshot as valid indefinitely is the most common mistake in any third-party risk program, and also the cheapest one to fix.

The fix isn't reassessing every vendor on the same schedule — it's setting a cadence proportional to each vendor's level of access and data sensitivity, and tracking signals in between those formal reviews.

When the vendor leaks, the notification is yours too

A data leak attributed to a vendor doesn't release the contracting company from regulatory responsibility — the notification obligation still falls on whoever owns the relationship with the end customer, even when the technical incident happened on a third party's infrastructure. That includes meeting the same three-business-day window Brazil's data protection authority already requires for any relevant incident.

Meeting that window requires knowing, quickly, which vendors have access to which data — information that only exists if the third-party inventory is kept current, not reconstructed under pressure in the middle of a crisis.

The vendor nobody formally approved

A large share of the most dangerous third-party risk never goes through the formal approval process at all. A business unit signs up for a new SaaS tool with a corporate card, connects it to the customer database through an integration, and that vendor never appears on any risk list because the security team doesn't even know it exists — the same dynamic behind the unapproved SaaS problem we've covered here before.

Without visibility into which vendors actually have access to company systems or data, any third-party risk program only covers a fraction of the real exposure — and usually the smaller fraction, the one that went through the formal process.

From point-in-time review to continuous monitoring

In practice, continuous monitoring means three things running at once: tiering vendors by access level and data sensitivity, to know where to focus effort; periodic reassessment proportional to that risk tier, not one fixed cycle for everyone; and tracking external signals between formal reviews — incident news, a change in ownership, a certification about to expire.

None of these three elements requires expensive tooling or a complex process to get started. What it requires is deciding that third-party risk is a continuous program, not a step that gets completed once and filed away.

Approved once doesn't mean secure forever

The question that decides real third-party risk isn't whether a vendor was approved — it's whether it still deserves that approval today, with the same scrutiny that applied on signing day. UNIQ helps clients turn a one-time vendor review into a continuous monitoring program, with the right visibility layer for each risk tier. Talk to the technical team before a third-party incident is what reveals the gap.