Cybersecurity Watch blog post for "third-party risk"