Which vendors should we review first?
CyberRank Research
Review first the vendors that support critical services or hold sensitive data. Within that group, move up any that use AI in decisions about people, hold data that must stay confidential beyond 2030, or ship software and updates into your environment. CyberRank combines the impact tier you assign with each vendor's breach likelihood in one heat map.
TL;DR
- Impact comes first: what stops if the vendor fails, and what data it holds.
- AI in decisions about people and data that must stay secret beyond 2030 move a vendor up.
- Vendors that ship software or updates into your systems are the routes supply chain attacks use.
- CyberRank's heat map puts critical-but-weak vendors at the top of the list.
The answer, piece by piece
| Part of the question | Short answer | Read more | How CyberRank helps |
|---|---|---|---|
| Impact and data | Short answerTier by what stops if the vendor fails and what data it holds | Read morehow to tier vendors in TPRM | How CyberRank helpsImpact tier × breach likelihood → risk level and heat map |
| AI use | Short answerMove up vendors with AI in hiring, education or access to essential services | Read morehigh-risk AI under the EU AI Act | How CyberRank helpsCandidate AI Act level and Annex III match (Beta) |
| Long-life data | Short answerMove up vendors holding data that must stay secret beyond 2030 | Read morequantum risk in vendors' cryptography | How CyberRank helpsQuantum-crypto posture per vendor (Beta) |
| Software you install | Short answerMove up vendors whose updates and packages enter your systems | Read moretypes of supply chain attacks | How CyberRank helpsVulnerability signals and fourth-party view |
Start with impact
Ask each business owner two questions per vendor: what stops if this vendor fails, and what data does it hold? Critical means failure halts a critical service or the vendor holds sensitive personal or financial data; High means essential, but the impact can be mitigated for a while. Review Critical first, then High. Why tiering comes before assessment is explained in detail in our guide to third-party risk management.
Add AI use
Within each tier, move up vendors whose AI falls in an Annex III area such as employment, education or access to essential services, because those uses can be high-risk and bring deployer duties for you. A match is a candidate, not a conclusion: your legal team confirms the level. The Annex III areas are explained in detail in our article about the EU AI Act and your vendors.
Add long-life data
Next, move up vendors that carry data which must stay confidential beyond 2030: health, financial, identity, legal and government data. Attackers can record that traffic today and decrypt it once a quantum computer exists, so a vendor's key exchange matters now. Why this makes quantum readiness a third-party risk is explained in detail in our guide to quantum security.
Add the software you install
Finally, move up vendors that ship software, updates or packages into your environment, and managed service providers whose administrative tools reach your systems. These are the routes used in SolarWinds, Kaseya and XZ Utils. The attack types are explained in detail in our article about supply chain attacks and how to prevent them.
Where CyberRank does not help
CyberRank cannot know what stops if a vendor fails; only your business owners can set the impact tier. It does not make the legal AI Act classification and cannot see a vendor's internal cryptography or build systems. It ranks vendors with the tiers and confirmations your team provides, and the final review order is your decision.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating