Your Company's Vendor Problem Starts Before Anyone Calls Security
When businesses pick software first and ask security questions second, they hand criminals a head start. Here is why fixing that order matters, and what a grown-up process actually looks like.
Key points
- Security teams are routinely the last department told about a new vendor purchase, creating gaps that attackers can exploit.
- Once a contract is signed, an organisation loses almost all practical power to demand that a vendor fix security problems.
- AI tools are accelerating the problem: staff often start using them immediately, entering sensitive business data into systems that were never vetted.
- A repeatable, documented vendor-review process, built into procurement before any deal is signed, is the only reliable fix.
- Contract language with financial consequences is the single most ignored feature of a mature vendor-risk programme.
Why does this keep going wrong?
A business team spots a shiny new platform. Operations wants it. Finance approves the budget. The deal is nearly done. Then somebody says: "Wait, what about security?" By that point, the security team has roughly zero leverage.
This pattern, described by several CISOs (Chief Information Security Officers, the executives responsible for an organisation's digital safety) writing recently in CSO Online, is not a niche problem. It is the default state at most companies. Security arrives last, asks the questions that should have been asked first, and ends up looking like the person who ruined the party.
The questions that needed answering were never complicated. What data will the vendor touch? Where will it be stored? What rules or regulations apply to that data? Does the vendor's own security actually meet those requirements? Reasonable questions. They just have to be asked before ink meets paper, not after.
What happens when the process is broken?
Weeks of delays hit everyone. The vendor sends questionnaires. Security asks for documentation that the vendor is slow to produce. Legal gets dragged in over data-flow clauses. The business team watches its launch date slip and blames security for the friction.
None of that friction disappears with a better process. It just moves to a point earlier in the timeline, where it costs far less and can actually change the outcome. A contract that includes specific security requirements, backed by financial penalties if the vendor fails to meet them, is the only instrument that gives an organisation real power over a third party after the deal closes. Without those clauses, a security gap found post-signature is essentially a politely worded complaint.
| Stage | What commonly happens | What should happen |
|---|---|---|
| Need identified | Business team searches for products | Business defines the problem and success criteria first |
| Vendor shortlisted | Security not yet involved | Security scoring included as a qualifying criterion |
| Contract negotiation | Security reviews after terms are nearly final | Security requirements and penalty clauses drafted in before signing |
| Tool goes live | Risk gaps logged but unresolved | Gaps formally accepted or blocked before deployment |
| Ongoing use | Annual review if lucky | Continuous monitoring with defined review triggers |
Does AI make this worse?
Yes, significantly. Two things are happening at once. Vendors are racing to bolt AI features onto their products, sometimes faster than their own security teams can evaluate them. At the same time, individual employees are signing up for AI tools on personal credit cards and using them at work, a practice sometimes called "shadow AI," meaning AI products adopted without the company's knowledge or approval.
The result: sensitive business data enters systems that were never assessed for privacy practices, data retention (how long the tool keeps what you type), or whether the AI model trains itself on your inputs and shares learned patterns with other users. That last point matters a great deal for anything confidential.
The traditional third-party risk problem was slow. This version is fast.
What should ordinary employees watch for?
If your employer has not published a clear policy on which AI tools are approved for work use, assume none of them are until you ask. Do not paste customer names, patient records, financial figures, or internal strategy documents into a free AI chat tool. Ask your IT or security team whether the tool has been reviewed. That one habit closes a significant gap.
For organisations building or overhauling their vendor review process, the practical steps are unglamorous but effective: agree who owns the intake process, set a fixed point at which security joins the evaluation, decide what evidence a vendor must provide, and write consequences for security failures into every contract before anyone signs.
A programme built on those foundations does not need heroics. It runs on process.
