[Cyber Security Terms](/glossary) Fourth-Party Risk [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) [Cyber Security Terms](/glossary) # Fourth-Party Risk ##### [Catherine Chipeta](/team/catherine-chipeta) updated Apr 23, 2024 ###### Contents ## What is Fourth-Party Risk? [Fourth-party risk](https://www.upguard.com/blog/what-is-fourth-party-risk) is risk brought on by your vendors’ vendors. An organization’s [cybersecurity practices](https://www.upguard.com/blog/cyber-security) can become obsolete if its vendors do not have a robust third-party risk management (TPRM) program in place to manage fourth-party risk. Beyond [third-party risks](https://www.upguard.com/blog/what-is-third-party-risk), [information security teams ](https://www.upguard.com/blog/information-security)should also account for fourth parties to create a comprehensive vendor risk management (VRM) framework. ## Why is Fourth-Party Risk Important? Fourth parties form part of an organization’s [attack surface](https://www.upguard.com/blog/attack-surface) and significantly increases the number of [attack vectors](https://www.upguard.com/blog/attack-vector) to which the organization is exposed. Regardless of where in the [supply chain a security incident occurs](https://www.upguard.com/blog/supply-chain-attack), an organization is always fully responsible for enacting an appropriate [incident response plan](https://www.upguard.com/blog/incident-response-plan). Despite third parties offering an added layer of protection during a fourth-party security incident, such an occurrence still exposes organizations to a significant level of [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). For example, if a fourth party suffers a [data breach](https://www.upguard.com/blog/data-breach) affecting a third party, the threat actor could access an organization’s [sensitive data](https://www.upguard.com/blog/sensitive-data) through the third party. Ensuring third parties are performing [vendor due diligence](https://www.upguard.com/blog/vendor-due-diligence) is crucial to mitigating this risk. ## Key takeaways * A fourth party is your vendors' vendor. Fourth-party risk is the risk incurred by these vendors. * Your organization is responsible for managing its fourth-party risk. * You must ensure your vendors are performing due diligence with their vendors to mitigate fourth-party risk. * * ###### Reviewed by No items found. ###### Author ##### [Catherine Chipeta](/team/catherine-chipeta) ###### Reviewed by ##### [Kaushik Sen](/team/kaushik-sen) ###### Join 27,000+ cybersecurity newsletter subscribers ## Read more about Fourth-Party Risks Learn more about Fourth-Party Risk and the latest issues in cybersecurity. [UpGuard](/blog/third-party-risk-management) [Third-Party Risk Management Guide for 2026](/blog/third-party-risk-management) #### [Third-Party Risk Management Guide for 2026](/blog/third-party-risk-management) Learn how to build and scale your third-party risk management program with expert guidance and a practical implementation checklist to minimize risk. [](/team/abi-tyas-tunggal) [Abi Tyas Tunggal](#) September 16, 2026 [UpGuard](/blog/what-are-security-ratings) [What are Security Ratings? Cybersecurity Risk Scoring Explained](/blog/what-are-security-ratings) #### [What are Security Ratings? Cybersecurity Risk Scoring Explained](/blog/what-are-security-ratings) This is a complete guide to security ratings and common use cases. Learn why security and risk management teams have adopted security ratings in this post. [](/team/abi-tyas-tunggal) [Abi Tyas Tunggal](#) December 10, 2025 [UpGuard](/blog/supply-chain-attack) [What is a Supply Chain Attack? Examples & Prevention Strategies](/blog/supply-chain-attack) #### [What is a Supply Chain Attack? Examples & Prevention Strategies](/blog/supply-chain-attack) Your business could be at risk of a data breach from a compromised vendor. Learn about supply chain attacks and how to best protect yourself. [](/team/edward-kost) [Edward Kost](#) January 8, 2025 [UpGuard](/blog/prevent-third-party-data-breaches) [9 Ways to Prevent Third-Party Data Breaches in 2026](/blog/prevent-third-party-data-breaches) #### [9 Ways to Prevent Third-Party Data Breaches in 2026](/blog/prevent-third-party-data-breaches) This is a complete guide to preventing third-party data breaches. Learn about how organizations like yours are keeping themselves and their customers safe. [](/team/abi-tyas-tunggal) [Abi Tyas Tunggal](#) December 28, 2025 [UpGuard](/blog/third-party-risk-management-important) [Why is Third-Party Risk Management Important in 2026?](/blog/third-party-risk-management-important) #### [Why is Third-Party Risk Management Important in 2026?](/blog/third-party-risk-management-important) This is a complete overview that outlines why third-party risk management is important. Learn about successful TPRM programs in this in-depth post. [](/team/abi-tyas-tunggal) [Abi Tyas Tunggal](#) September 16, 2026 [UpGuard](/blog/vendor-risk-management-best-practices) [Vendor Risk Management Best Practices in 2026](/blog/vendor-risk-management-best-practices) #### [Vendor Risk Management Best Practices in 2026](/blog/vendor-risk-management-best-practices) Vendor risk management can help prevent data breaches and is increasingly a key part of regulatory compliance. [](/team/abi-tyas-tunggal) [Abi Tyas Tunggal](#) September 16, 2026 [View all blog posts](/blog) ## See UpGuard In Action Book a free, personalized onboarding call with one of our cybersecurity experts. [Contact sales](/demo) [Free demo](/demo) ## More from our blog Learn more about the latest issues in cybersecurity. [UpGuard](/blog/find-out-if-youre-exposed-on-the-dark-web) [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 [UpGuard](/blog/upguard-named-leader-in-idc-marketscape) [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 [UpGuard](/blog/your-first-dark-web-scan-report-explained) [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [UpGuard](/blog/ai-evidence-analysis-tools-for-tprm) [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 [UpGuard](/blog/cybersecurity-horror-stories-2026) [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 [UpGuard](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 11, 2026 [View all blog posts](/blog) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)