Zlatko Hristov nails the Qantas pattern: you are only as strong as your weakest vendor. A third-party call centre on Salesforce was enough. He also flags data minimisation - why did a feedback form need a mobile number?
Finding vendors that treat security as more than a marketing page is already hard. What I see in SMEs makes it worse: the weak link is often inside the building, unpaid and unreviewed.
- Shadow IT - software installed on laptops with no review
- Shadow SaaS - staff signing up to cloud tools and dumping customer data into them
- Shadow AI - the same pattern with chatbots and copilots, only faster and with broader paste-into-prompt habits
Vendor questionnaires catch the named supplier. They miss the unpaid ChatGPT tab and the "temporary" Notion workspace that became permanent.
If you only diligence the logo on the contract, you are measuring the wrong perimeter. Ask who else already has the data - including your own teams.
Find this on LinkedIn and give it a thumbs up: You are only as strong as your weakest vendor
Related