A Supply Chain Risk Management (SCRM) platform can flag a critical vendor vulnerability in real time, yet still leave you with no way to force a fix. Without contractual rights to mandate timelines, an alert is just information. This post therefore looks at why that gap exists, what it costs security teams in practice, and how to close it before the next alert fires.
You did everything by the book. First, you ran the vendor bake-off. Then you deployed an automated SCRM platform, and now you have continuous visibility into your third-party attack surface. Suddenly, an alert fires: a key vendor runs a system with a critical, known vulnerability.
Naturally, you call the vendor to request a fix. However, they point you to the Service Level Agreement, and nothing in it obligates them to remediate this specific class of issue, let alone on a timeline you set. So the call ends. The vulnerability, meanwhile, doesn’t.
The illusion of control
Many InfoSec teams face an uncomfortable truth: visibility without authority is organised anxiety. In other words, you can see the risk, but you cannot compel anyone to act on it.
Recent incidents follow the same pattern
The pattern repeats across recent incidents. For example, when CVE-2025-53770 (“ToolShell”) surfaced in Microsoft’s on-premises SharePoint Server in July 2025, organisations with no contractual right to demand emergency patching timelines had to wait on their vendors’ own patch cycles. Meanwhile, state-linked threat actors exploited the flaw within days, compromising servers at well over 100 organisations worldwide, including US federal agencies.
Similarly, the July 2025 ransomware attack on IT distributor Ingram Micro followed the same shape. Resellers and managed service providers that depend on its ordering platform had no clause in their contracts guaranteeing a restoration timeline. As a result, order processing and licence renewals for thousands of downstream businesses stalled for the better part of a week.
Vendors that still run unsupported, end-of-life software are another common example.
Crucially, none of this is a monitoring failure. Organisations running continuous risk-rating platforms such as Black Kite saw these exposures the moment they surfaced. Instead, the failure sits one layer down, in the legal instrument that should have turned that visibility into leverage.
Modern monitoring, outdated contracts
Cybersecurity teams are buying 21st-century monitoring tools and shackling them to 20th-century legal frameworks. Legal teams drafted most vendor contracts before continuous monitoring existed as a category, so those contracts rely on point-in-time compliance evidence and annual questionnaires rather than real-time telemetry. Consequently, a contract from that era has no clause that says: “when your security rating drops below X, or we confirm a known vulnerability in your environment, you will remediate within Y days and confirm it in writing.” Without that type of clause, your analysts can only watch the exposure sit there, unpatched, for as long as the vendor’s own priorities allow.
That’s the trap. The SCRM tool did its job, but the contract didn’t do its part. Ultimately, it turns a trained security team into a group of very well-informed bystanders watching a car crash in slow motion, with a dashboard that confirms exactly how it’s unfolding.
Why a questionnaire isn’t an enforcement mechanism
A signed compliance questionnaire is a snapshot of what a vendor claims on the day they filled it in. It does not show what their environment looks like six months later, and it certainly cannot enforce anything. Telecom Namibia, for instance, suffered from this exact gap: exposed infrastructure sat on Shodan for months because contracts lacked enforcement mechanisms.
Bridging the gap between the CISO and General Counsel
Fixing this requires the CISO and General Counsel to work from the same document, rather than keeping two separate versions in different systems. In addition, vendor contracts can no longer sit in a drawer after signature. Instead, they need to function as operational tools that give the security team a mechanism to act on what the tech stack surfaces.
In practice, that means negotiating specific, measurable clauses before signature, not after an incident:
None of these clauses require reinventing procurement from scratch. They do, however, require the security team to sit in the room during contract negotiation and renewal, rather than receiving a signed PDF after the fact. Where existing vendor contracts are already in force, a renewal cycle or a targeted amendment is the practical entry point, so you don’t need to renegotiate every vendor relationship at once.
Conclusion: a tech stack only enforces what the contract lets it enforce
Third-party risk monitoring tools are only as useful as the authority behind them. If you buy better visibility without updating the legal framework it operates inside, you turn a security control into a very expensive early-warning system with no way to act on the warning. In short, the fix isn’t more tooling. Instead, it’s making sure the contracts your legal team signs give your security team the standing to demand the remediation your tools already told you was necessary.
Ready to stop watching and start enforcing? Join Elasticito’s upcoming webinar, Are Your Vendor Contracts Secretly Sabotaging Your Cybersecurity?, to learn how to align your tech investments with your legal agreements.
Register for the webinar here.
Frequently asked questions
What should a vendor contract require when a risk-rating tool flags a critical vulnerability?
First, it should set defined remediation windows tied to severity (for example, CVSS 9.0+). Second, it should demand proof of fixes. Otherwise, “we’ll get to it” remains a perfectly legal response.
What’s the practical difference between a compliance questionnaire and continuous monitoring?
A questionnaire is a vendor’s self-reported snapshot on the day they filled it in. Continuous monitoring, by contrast, tracks the vendor’s actual external security posture on an ongoing basis through a platform like Black Kite. As a result, the two can diverge within weeks of a signed attestation.
Do existing vendor contracts need to be renegotiated from scratch to fix this?
No. Instead, update terms during upcoming contract renewals. Alternatively, introduce targeted security amendments without renegotiating entire contracts.
What counts as a reasonable remediation timeline for a critical CVE?
Timelines vary, but you must document them. For example, tier deadlines by severity so that CVSS 9.0+ vulnerabilities get the fastest fixes.
Should the CISO or General Counsel own vendor contract negotiation?
Both teams must collaborate. Without Security, legal contracts miss technical triggers; equally, Security needs Legal to ensure enforceability.
