Notes · 4 of 8
Your vendor has a vendor. Here is the question to send.
The question your most important vendor has never been asked, and how to put it in writing.
This season I sat down with a vendor and showed them a problem on a server with their name on it.
We watch what is publicly visible about organizations and the vendors that serve them. We had noticed the problem on a public server belonging to a vendor that serves several offices. Any visitor could have seen it. We told one of those offices, and the office asked the vendor.
The vendor's first answer was that what we described didn't match their environment.
So I sat down with them and walked through the evidence on a screen, step by step. It showed what that server was telling any visitor. They recognized it then. It sat outside the service they run for the office, and another company hosts it. Their engineers were frank about it. Some of their web pages are run by others, and they don't fully control them.
They took it to their own security team. We had something to correct too: one label in our report was wrong, and we fixed it.
An honest answer about the wrong part
The vendor was not careless or dishonest. Their first answer was true of the systems they run for that office. They just didn't run the part that had the problem. Nobody had asked them who did.
A vendor can only answer for what they run. Your contract names one company. The service you depend on may be run by several.
Picture a morning when that service is down, the week of a date you cannot move. You call your vendor. They tell you, truthfully, that everything looks fine on their side. An hour goes by while people work out whose side it is.
That hour is how an outage becomes a story.
What only you can do
Ask — the question nobody has asked. Who else runs part of this, and who do we call there? Start with the vendor whose bad day would become yours.
Require — the answer, in writing, by a date. You are not asking your vendor to fix anything. You are asking who is behind them, before you need to know.
Copy and send: Which other companies host or run any part of what you provide us, and who do we call at each if it goes down? Please answer in writing by [DATE].
Send it yourself, under your own name. Choose a date well ahead of the next day you cannot move, and put it on your calendar. A fast answer gives you names and numbers. A slow one tells you something too.
Keep the answer as one page you can read on a bad morning. One line per company: what part of your service they run, the number to call, who answered when you tested it, and the date.
Some vendors will say the list is confidential. You are not asking how their systems work. You are asking who else runs part of your service, and who answers the phone. A vendor that won't say has still answered. Record it.
When the contract comes up for renewal, write it in: The vendor keeps a current list of the companies that host or run any part of the service, with a contact at each, and tells us within thirty days when it changes.
Confirm — that the number works. Josh Friesen, a reader of this series, wrote this in a comment: "Call the number on a Tuesday when nothing is wrong. If you can't get a human in five minutes with zero stakes, you won't get one at 6am on the day it matters."
Decide — when you ask again. Companies change who hosts them. Put next year's date on your calendar now.
The short version, for this week:
Ask (who is behind your vendor) · Require (the answer in writing, by a date) · Confirm (call the number on a quiet day) · Decide (when you ask again)
The first answer again
The vendor's security team took it from there. When we looked again a few weeks later, the software on that server had been updated.
What I keep coming back to is the first answer. It was honest. It was about the part they run. Nobody had asked about the rest.
You don't need to run your vendor's systems. You need one page of names and numbers, written down while nothing is wrong.
An honest answer only covers what the person answering can see. Ask who sees the rest.
If you'd rather not say it in public, message me. I'll tell you the first question I'd ask.
Next · 5 of 8 · A new hire gets an interview. An AI assistant gets a login.