The Vendor You Never Onboarded Still Has Your Data

We have a whole industry built around vetting who gets access to our systems. Background checks. Security questionnaires. SOC 2 reports before we’ll even get on a call. Legal going line by line through the data clause in every vendor contract. By the time a new vendor is live in our environment, half a dozen people have signed off on them.

Then someone attaches the file and emails it over.

That’s the part nobody vets. The subcontractor the vendor brought in without telling us. The paralegal at outside counsel who has never seen our security policy. The freelancer a few layers down the chain, opening our numbers on a personal laptop. None of them went through the process, and none of that matters, because the file doesn’t know or care who opened it. It just opens.

I think we’ve been solving the wrong half of this problem. All that vetting is aimed at the relationship: who do we trust enough to let in. But the risk was never really about the relationship. It’s about the document, and a document doesn’t stop being sensitive because the person holding it passed a background check at some other company three jobs ago.

Here’s the test I’d put to any team that thinks vendor risk has this covered. Pull up the last five files you sent to someone outside the company. Not the ones they accessed, the ones you sent. Now tell me, in under a minute, who can still open each of them. If you can’t, then onboarding didn’t protect the thing it was supposed to protect. It protected the login.

None of this is an argument for slower vendor reviews or more paperwork. Most of that upfront vetting exists because we don’t have a better answer, so we try to control who gets close to the data in the first place. If the file itself had the rules attached, who can open it, what they can do with it, for how long, you’d still do your diligence. You just wouldn’t have to bet the whole outcome on it.

Trust is also a moment in time. The vendor you vetted last spring may be gone by this fall: the contract ended, the project got shelved, the person you dealt with moved on. The file you sent them doesn’t know any of that. It sits where it landed, and the only thing protecting it is the paperwork you signed back when everyone was still friends.

A file with its own rules attached changes that. You can see who has opened it, and you can change your mind after you’ve sent it, instead of hoping the contract covers you. We spend months deciding who we trust. We should be able to revisit that decision after we hit send.