The MOVEit Breach, One Year Later: What It Changed About Vendor Risk

The 2023 MOVEit Transfer breach — exploited via a SQL injection zero-day by the Cl0p ransomware group — didn't compromise thousands of organizations directly. It compromised one widely-used managed file-transfer product, and the exposure cascaded through every organization (and every organization's vendors, and their vendors) that relied on it.

The vendor-risk lesson that actually generalizes

Traditional vendor risk assessment asks "is this vendor secure," evaluated roughly once a year. MOVEit-style cascades expose a different question vendor-risk programs are generally worse at answering: "how concentrated is our exposure to a single product, and what's our actual blast radius if that specific product has a zero-day tomorrow?"

1. Maintain a real inventory of which vendors' products handle sensitive data flows, not just which vendors have signed a security questionnaire.
2. Track concentration risk — how many critical processes run through a single third-party product.
3. Build an incident-response playbook for "our vendor was breached," not just "we were breached" — the notification and remediation mechanics are genuinely different.