Lion Cipher Lab
Map fourth-party dependencies and measure concentration risk
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Third-party risk programs usually assess vendors one at a time: a questionnaire, a SOC 2 report, a contract review. Each vendor can pass on its own and the portfolio can still be fragile, because the vendors share what they depend on. Your payment provider, your e-commerce platform and your single sign-on service may be three different companies running on the same cloud provider behind the same content delivery network. When that shared fourth party (your vendor's vendor) has an outage, all three fail at once, and your incident plan, which assumed independent failures, does not hold. This is…
What you'll learn
- the difference between third-party and fourth-party risk
- what concentration risk is and why diverse vendor lists can hide it
- collecting sub-processor and hosting dependencies
- scoring shared dependencies by criticality
- following dependency chains transitively
- treating missing dependency data as a finding
- turning concentration findings into resilience actions
Steps in this lab
- Third parties, fourth parties, and concentration
- Collect the data: vendors and what they depend on
- Write the concentration analyzer
- Run it and read the concentration
- Look deeper than one level
- Turn findings into resilience decisions