The growing problem of shared risk, and why every business leader should be paying attention.
Taking a look at the catalyst of the decline, the aftershocks that have followed and where we are now compared to 2019.
How much of your organization’s cybersecurity risk originates outside your business?
And how much of someone else’s risk depends on you?
I think these are questions that every business leader should be asking, regardless of industry.
Consider a law firm that relies on a cloud-based document management platform. A commercial real estate company whose property management systems are operated by an outside vendor. A construction company exchanging architectural drawings, contracts, and financial information with dozens of subcontractors.
Each organization has its own systems, employees, and cybersecurity practices. But much of the technology they depend on, and the information they are responsible for protecting, extends well beyond their own business. This isn't necessarily a bad thing. Specialization, outsourcing, and shared technology have made businesses more efficient and capable than ever before. They've also created dependencies that aren't always well understood.
When Someone Else’s Problem Becomes Yours
We've seen several examples of this throughout 2026.
EDUCATIONAL PLATFORM COMPROMISED
In April and May, attackers compromised Canvas, a widely used educational platform operated by Instructure. The incidents involved unauthorized access to information and a subsequent compromise that allowed attackers to modify pages displayed to students and educators. Instructure temporarily took the platform offline while investigating and containing the attacks. Consider the implications. Thousands of educational institutions depend on a common technology platform, yet each institution has limited control over the security of the underlying service. A vulnerability affecting that provider can create consequences for organizations that otherwise have no relationship with one another.
ONE ATTACK-MULTIPLE ORGANIZATIONS VULNERABLE
A similar problem surfaced in June when a critical vulnerability was discovered in PTC's Windchill and FlexPLM software. These applications are used by manufacturers to manage product designs, engineering documentation, and other sensitive information throughout a product's lifecycle. Attackers exploited the vulnerability, creating opportunities for unauthorized access to systems containing valuable intellectual property. The point I want to stress here is not that another software vulnerability was discovered. It's that organizations across an entire industry may depend on the same technology to protect some of their most valuable information – and the ability to conduct business.
The same concern applies to law firms using common document management platforms, construction companies sharing building designs through project collaboration systems, and financial institutions relying on common transaction-processing services.
OUT OF YOUR HANDS
An organization's cybersecurity risk increasingly depends on the security decisions made by businesses it may never directly interact with – its cloud and service providers.
The Problem With Shared Responsibility
There's a concept in cybersecurity called the Shared Responsibility Model. The premise is straightforward: when multiple organizations participate in delivering or operating a service, each has responsibilities for protecting the systems and information involved. The difficulty is establishing exactly where those responsibilities begin and end.
QUESTIONS TO ASK BEFORE IT’S TOO LATE
Your IT provider may be responsible for maintaining your computers, but who determines which employees should have access to your confidential information? Who monitors suspicious activity in the IT providers’ systems? Who verifies that backups can actually be restored? And who is responsible for the security of the technology your provider uses to administer your systems? These aren't questions that should first be answered during a cybersecurity incident.
In an earlier article, Who's Responsible? Everyone—and No One: Why Shared Responsibility Models Matter More Than Ever, I examined why clearly defining these responsibilities is essential.
Assigning someone responsibility for cybersecurity doesn't necessarily establish who is accountable for implementing a particular safeguard, what that safeguard is expected to accomplish, or how anyone determines whether it's working.
REQUIRED FRAMEWORK
This is where established cybersecurity frameworks become important. A framework is essentially a structured set of requirements and recommended practices that organizations can use to identify risks, establish appropriate protections, and measure how effectively those protections are implemented. Frameworks such as the CIS Controls provide specific, actionable safeguards, while regulations such as the European Union's NIS2 establish cybersecurity risk-management obligations for organizations within their scope.
These provide a common basis for defining what needs to be done. The challenge is establishing who is responsible for each requirement, making certain the necessary protections are actually implemented, and verifying that they work as intended. Simply assigning responsibility to someone, whether an employee, an IT provider, or another outside organization, doesn't accomplish any of those things.
Cybersecurity Is Becoming a Supply-Chain Issue
We've spent years thinking about cybersecurity as something that happens within the boundaries of an individual organization. That view is increasingly incomplete. Consider the widespread use of Microsoft cloud technologies, including Microsoft 365, Outlook, Teams, and SharePoint. Millions of businesses depend on these services for everyday communications, document storage, and collaboration. A law firm may use SharePoint to exchange confidential client documents, while a construction company uses Teams to coordinate projects with architects, engineers, and subcontractors. A financial services firm may rely on Outlook and other cloud applications to communicate with customers and exchange sensitive financial information.
ONLY AS STRONG AS THE WEAKEST LINK
These organizations may operate in entirely different industries, with different cybersecurity requirements and practices, yet they share a common dependency on the same underlying technology. And Microsoft is only one part of that picture. Businesses also depend on common accounting platforms, payroll processors, banking services, document management systems, and IT service providers, many of which rely on additional technology providers themselves. A security failure affecting one of these shared services can have consequences for thousands of otherwise unrelated organizations. Equally important, a weakness in how one organization configures or manages its access to a shared platform can expose information belonging to its customers, business partners, or other third parties.
IT’S A TWO-WAY STREET
The result is a network of interconnected responsibilities that extends well beyond any single organization's systems. Understanding those relationships, and who is responsible for protecting the information and services involved, is becoming an essential part of managing business risk. A law firm's cybersecurity depends partly on its document management provider. A financial institution depends on its transaction processors. A construction company depends on subcontractors, engineering firms, and the platforms used to exchange project information.
And those relationships work in both directions. Your organization may be somebody else's critical dependency.
This is one reason we're seeing greater attention to third-party cybersecurity requirements, contractual obligations, and independent security assessments. Customers increasingly want evidence that the organizations they depend on are implementing appropriate protections. In When Your MSP Becomes a Vector of Risk, I examined an incident involving Absolute Dental in which a trusted IT service provider's access became part of the attack. The resulting breach affected more than 1.2 million individuals.
The lesson wasn't that organizations should stop trusting their providers. It was that trust needs to be supported by clearly defined responsibilities and meaningful verification.
What Should Business Leaders Take Away?
I suggest starting by identifying which outside organizations have access to your sensitive information, business systems, or critical operations. Then identify the cybersecurity requirements that apply to your business, including contractual commitments, regulatory obligations, and the types of information you're responsible for protecting. Established cybersecurity frameworks, such as the CIS Controls, provide a practical basis for translating those requirements into specific safeguards. From there, develop a documented Shared Responsibility Model (SRM) that identifies exactly which safeguards each organization is responsible for implementing, operating, and monitoring, which responsibilities remain with you, and how their effectiveness will be verified.
STARTING POINT: BUSINESS REQUIREMENTS
The objective isn't simply to establish that your providers have cybersecurity responsibilities. It's to understand precisely what protections your business requires, who is accountable for each one, and what evidence demonstrates that those protections are actually in place and working as intended. These are reasonable business questions. They don't require a technologist to understand the technical details of a software vulnerability or become a cybersecurity professional. Start with the business requirements and expand from there.
THE RISK GOES BEYOND YOUR ORGANIZATION
As we approach 2027, I think this deserves considerably more attention from business leadership. Cybersecurity is no longer exclusively an internal technology concern. It is increasingly a question of how organizations manage the dependencies that allow them to operate. Because cybersecurity risk doesn't stop at your organization's boundaries. And neither does your responsibility to the people and businesses that depend on you.
