SaaS vendor security has become the discipline of deciding which of those companies deserve that access, and on what terms. Reassess annually and after any vendor security incident. Why third party risk stopped being a formalityFor most of the last decade, vendor security reviews were a compliance ritual. Frequently asked questionsHow long should a vendor security review take? Who should own vendor security in a company without a security team?