When you rely on third-party service providers, their security failures become yours. Password-manager breaches show how a provider's compromise can damage your business. Before outsourcing, get contracts that require them to tell you immediately if they're breached.
Otherwise, some risk will go unattended. And if it's your service provider that got hacked, now you have a problem. Do you remember how many password managers were hacked recently and credentials stolen? By no means, I don't say avoid the cloud, but it's just someone else's computer. So there are risks everywhere. Are you accepting this risk as a business or not? So should I keep it internally with— and I see the cost— should I externalize it and reallocate my resources at other things which are more core? It's more of a business decision, but there are risks involved. And we see growing chain of supply attacks. So do you have the right contractual agreements? So if your service provider got hacked, Is he forced to divulge that he's been breached or not? This you need to be aware. So it's the same. Your contractor is subject to the same cyberattack as you are. And is it a risk that you're willing to have and managing? That's the question.
