Your Vendors Are One Portfolio: Using FAIR to Quantify Aggregate Third-Party Risk

You have a vendor list. Maybe it's 200 rows in a spreadsheet. Maybe it's 2,000 rows in a GRC tool. Either way, you've probably asked the same question: which of these vendors is going to hurt us?

That's the wrong question. The right question is: what is the total amount of money we could lose across all of them, in a bad year? Because your vendors aren't a list. They're a portfolio. And portfolios have properties that individual items don't — correlation, concentration, and a tail that can be far worse than the sum of its parts.

FAIR (Factor Analysis of Information Risk) gives you a way to answer that portfolio question with a number, not a gut feel. This is the fourth post in our FAIR deep-dive series, and it's the one that moves beyond single-asset scenarios into the territory that actually keeps CFOs up at night: aggregate exposure.

Single-Scenario FAIR vs. Portfolio FAIR — Why the Unit-of-Analysis Changes Everything

Standard FAIR analysis answers one question: what is the loss exposure for a specific asset, threat, and effect combination? You pick a scenario — say, a ransomware attack against your CRM vendor that encrypts your customer data — and you estimate the loss event frequency and the loss magnitude. You get a single number, usually expressed as a range or a distribution.

That's useful. It tells you whether a particular vendor deserves your attention. But it doesn't tell you what your total third-party risk is. And that's the question your board is actually asking when they say "how exposed are we?"

Here's the shift: when you move from single-scenario to portfolio FAIR, the unit of analysis changes from one loss event to the distribution of total losses across all scenarios in a defined period. You're no longer asking "what happens if vendor X fails?" You're asking "what happens if any combination of vendors fails, and how bad can the combined outcome get?"

This matters because the math changes. Single-scenario FAIR gives you an expected loss. Portfolio FAIR gives you a loss distribution — and the shape of that distribution is driven by correlation, not just by the individual expected values. Two vendors with identical individual risk profiles can produce very different portfolio outcomes depending on whether their failure modes are independent or correlated.

Think of it like insurance. An insurer doesn't price a single house; they price a portfolio of houses. They care about the probability that many houses burn down in the same wildfire, not just the probability that one house burns down. Your vendor portfolio is the same. The question isn't just "how likely is vendor A to fail" — it's "how likely are vendors A, B, and C to fail in the same quarter, and what does that do to us?"

The Aggregation Problem — The Risk Isn't the Sum of Your Vendors, It's the Correlated Tail

Here's the trap: you add up the expected loss from each vendor, and you get a number. That number feels like your total risk. It isn't. It's the sum of the averages, and the sum of the averages dramatically understates the risk in the tail.

Why? Because vendor failures aren't independent. They cluster. And when they cluster, the losses compound.

Consider the common-mode failure. You have 40 vendors. Thirty of them use the same managed service provider (MSP) for their infrastructure. That MSP gets breached — say, a supply-chain attack on their remote monitoring tooling. Suddenly, 30 of your vendors are compromised simultaneously. The losses aren't additive; they're multiplicative. Your incident response team is overwhelmed. Your legal exposure multiplies. Your customers notice. The board notices.

This is the aggregation problem: the risk isn't the sum of your vendors, it's the correlated tail. One MSP, one identity platform, one cloud region — these are single points of failure that turn a portfolio of seemingly independent risks into a single, massive, common-mode event.

And it's not just shared infrastructure. It's shared vectors. If your top 20 vendors all use the same identity provider, and that provider has a vulnerability, you have a concentration risk. If they all use the same email security gateway, and that gateway fails, you have a concentration risk. The correlation isn't always visible in the vendor's own risk profile — it's visible in the structure of your portfolio.

This is why a simple vendor risk scorecard fails. A scorecard treats each vendor as an independent entity. It gives you a red/yellow/green rating per vendor. But it can't see the pattern across vendors. It can't tell you that your "green" vendors are all green because they all use the same cloud provider, and that provider is one incident away from turning your entire portfolio red.

Building the Per-Vendor Analysis — Scoping Each Critical Vendor to Its Own FAIR Scenario

Before you can aggregate, you need per-vendor scenarios. But you don't need a full FAIR analysis for every vendor. You need it for the ones that matter — and you need it scoped correctly.

For each critical vendor, define a FAIR scenario with three components:

• Data processed: What data does this vendor hold or process? Customer PII? Financial records? Intellectual property? Employee data? The sensitivity of the data drives the loss magnitude.
• Access: What can this vendor reach? Do they have network access to your internal systems? Do they have credentials that could be used to move laterally? Do they have access to your other vendors' systems? Access drives both the loss event frequency and the blast radius.
• Blast radius: If this vendor is compromised, what's the maximum plausible loss? This includes direct costs (forensics, notification, legal), indirect costs (business interruption, customer churn), and secondary costs (regulatory fines, reputational damage, loss of future revenue).

Here's a concrete example. Say you use a payment processor. The scenario: a breach of the payment processor's systems that exposes your customers' card data. The data is highly sensitive. The access is direct — they process transactions on your behalf. The blast radius includes PCI fines, card reissuance costs, customer notification, potential class-action litigation, and reputational damage that could reduce future sales. Your FAIR analysis might give you a loss event frequency of once every 5 years (20% annual probability) and a loss magnitude of $2M to $15M. That's a single-scenario number.

Now do the same for your CRM vendor. The data is less sensitive (sales pipeline, not card data). The access is moderate (they have API access, not direct network access). The blast radius is smaller — maybe $500K to $3M. And your identity provider? The data is highly sensitive (credentials), the access is total (they authenticate everything), and the blast radius is enormous — potentially $10M to $50M if a compromise leads to a full account takeover across your environment.

These three scenarios give you three numbers. But they don't give you the portfolio number. For that, you need to understand how these scenarios correlate.

Correlation Is the Real Insight — When Do Vendor Losses Move Together?

Correlation is the difference between a portfolio that's manageable and a portfolio that's a time bomb. Here's how to think about it.

The portfolio's risk isn't the sum of your vendors — it's the correlated tail. Two losses that share a common cause can hit at once.

Two vendor losses are correlated when they share a common cause. The cause can be:

• Shared infrastructure: Both vendors use the same cloud provider, the same MSP, the same data center, the same network backbone.
• Shared software: Both vendors use the same third-party library, the same identity platform, the same email gateway, the same backup tool.
• Shared threat actor: A single attacker or attacker group targets both vendors because they share a vulnerability or because they're both in the same supply chain.
• Shared economic conditions: A recession hits both vendors' ability to invest in security. A regulatory change affects both. A talent shortage affects both.

When you identify these shared causes, you can start to estimate correlation. It's not a precise science — you're not going to get a correlation coefficient to two decimal places. But you can categorize: high correlation (shared infrastructure AND shared software), medium correlation (one shared element), low correlation (no obvious shared elements).

Here's the insight that changes your risk picture: concentration risk is correlation made visible. If 30 of your 40 critical vendors use the same MSP, you have a concentration. The correlation between any two of those vendors is high — not because they're similar, but because they share a single point of failure. Your portfolio risk is dominated by that concentration, not by the individual vendor risks.

Let's make this concrete with a table. Consider three vendors:

The payment processor and the CRM platform share Cloud A. If Cloud A has a major outage or a security incident, both could fail simultaneously. Their losses are correlated. The identity provider is on Cloud B, so it's less correlated — but if the identity provider fails, the blast radius is so large that it dominates the portfolio regardless.

This is the real insight: correlation tells you where the tail risk lives. It tells you which combinations of vendor failures are plausible, and which are effectively impossible. And it tells you where diversification — or the lack of it — shows up in your numbers.

Aggregating to a Portfolio Number — The Portfolio LEC and What Diversification Shows

Now you can aggregate. The goal is a portfolio loss exceedance curve (LEC) — a chart that shows the probability of exceeding any given loss level in a year. This is the same tool insurers use, and it's the tool your CFO will understand immediately.

Here's how to build it:

1. Define your scenarios. You've already done this — each critical vendor gets its own FAIR scenario with a loss event frequency and a loss magnitude distribution.
2. Assign correlations. For each pair of scenarios, estimate the correlation: high, medium, or low. Use the shared-cause analysis from the previous section.
3. Run a Monte Carlo simulation. Simulate 10,000 years. In each year, roll the dice for each scenario — did it occur? If it occurred, what was the loss magnitude? Apply the correlations — if two scenarios are highly correlated, they tend to occur in the same simulated years. Sum the losses across all scenarios for each simulated year.
4. Plot the results. Sort the simulated years by total loss. The 90th percentile is your 1-in-10-year loss. The 99th percentile is your 1-in-100-year loss. This is your portfolio LEC.

You don't need a PhD in statistics to do this. A spreadsheet with a random number generator and a correlation matrix will get you 80% of the way. There are also commercial tools that do this natively. The point is the structure of the analysis, not the tool.

What you'll find is that the portfolio LEC is almost always higher than the sum of the individual expected losses. Here's why: the tail events — the 1-in-100-year scenarios — are where the correlated losses pile up. In a bad year, you don't get one vendor breach. You get three, because they all share a common cause. The portfolio LEC captures that.

And here's where diversification shows up. If your vendors are truly independent — different clouds, different MSPs, different software stacks — the portfolio LEC will be closer to the sum of the individual expected losses. The tail is thinner. If your vendors are highly correlated — all on the same cloud, all using the same identity provider — the portfolio LEC will be much higher than the sum. The tail is fat. That fat tail is your concentration risk, and it's the number you need to manage.

Feeding Cyber Insurance and Vendor Risk Programs — How the Aggregate Number Changes Decisions

The portfolio LEC isn't an academic exercise. It changes real decisions.

Cyber insurance. Your aggregate number tells you how much coverage you actually need. If your 1-in-100-year loss is $40M, and your current policy covers $10M, you have a $30M gap. That's a board-level conversation. The portfolio LEC also informs your retention (deductible). If your expected annual loss across all vendors is $2M, a $1M retention means you're self-insuring half your expected losses — which might be fine, but you should make that decision consciously, not by accident.

Insurers are also starting to ask about vendor concentration. If you can show them a portfolio LEC that accounts for correlation, you're ahead of most companies. You can negotiate from a position of understanding, not guesswork. And if your portfolio is highly concentrated, you might find that insurers charge you more — or that you can reduce your premium by diversifying your vendor infrastructure.

Vendor risk programs. The aggregate number changes how you qualify vendors. Instead of a binary "approved/not approved" based on a checklist, you can use the portfolio view to make strategic decisions:

• Vendor qualification: If a new vendor would increase your concentration (e.g., they use the same MSP as 30 of your existing vendors), you can quantify the marginal increase in portfolio risk. If the increase is material, you can push back or require compensating controls.
• Contract terms: Your aggregate number tells you which vendors are the biggest contributors to your tail risk. Those are the vendors where you negotiate stronger indemnification, higher insurance requirements, and more aggressive audit rights.
• Risk acceptance: When a business unit wants to onboard a vendor that adds concentration risk, you can present the portfolio impact in dollars. "This vendor adds $3M to our 1-in-100-year loss. Is the business benefit worth that?" That's a decision the business can actually make.

This connects directly to your risk assessment practice. A traditional risk assessment tells you which vendors are risky. A portfolio FAIR analysis tells you how much risk you're carrying in total, and where the concentration is. That's the difference between a compliance exercise and a risk management capability.

Practical: Which Vendors Actually Deserve a Full FAIR Analysis vs. a Lighter Qualitative Pass

You can't do a full FAIR analysis on 2,000 vendors. You shouldn't try. Here's a triage framework.

Tier 1 — Full FAIR analysis (top 5-10% of vendors): These are the vendors that process highly sensitive data, have broad access to your environment, or are so deeply embedded that their failure would stop your business. For each of these, build a proper FAIR scenario with a loss event frequency and a loss magnitude distribution. These are the vendors that drive your portfolio tail.

Tier 2 — Light quantitative pass (next 15-20%): These vendors matter, but they don't dominate. For each, estimate a rough loss magnitude range (low/mid/high) and a rough annual frequency (e.g., 1-in-10, 1-in-50). You don't need a full distribution — a point estimate with a range is enough to include them in the portfolio simulation with a rough correlation assumption.

Tier 3 — Qualitative pass (remaining 70-80%): These vendors are low-risk or low-impact. A checklist-based assessment is fine. They don't move the portfolio number. Reassess them annually, or when something changes (new data, new access, new contract).

Here's the triage criteria in a table:

The key is to be honest about which tier each vendor falls into. Most organizations over-invest in Tier 3 analysis and under-invest in Tier 1. The 10% of vendors that are Tier 1 drive 90% of your portfolio risk. Spend your analytical effort there.

And remember: the portfolio analysis is iterative. You don't build it once. You build it, review it quarterly, and update it when you add or remove vendors, when contracts change, or when the threat landscape shifts. The first pass will be rough. It will get better.

From Vendor List to Portfolio Number

Your vendor list is a portfolio. It has concentration, correlation, and a tail. A scorecard can't see that. A compliance checklist can't see that. Only a quantitative, portfolio-level analysis can.

FAIR gives you the framework. The portfolio LEC gives you the number. And that number — your 1-in-10-year and 1-in-100-year loss across all vendors — is what your board needs to make informed decisions about insurance, vendor selection, and risk acceptance.

Start with your Tier 1 vendors. Build their scenarios. Identify the shared infrastructure and shared vectors. Run the simulation. You'll likely find that your aggregate exposure is higher than you thought — and that a handful of concentration points are driving most of it. That's not bad news. That's actionable intelligence.

If you want help building this analysis — or if you want a second opinion on your current vendor risk program — our vCISO team has done this for dozens of organizations. We can help you scope the scenarios, identify the correlations, and build the portfolio model that your CFO will actually trust. And if you want to see what your aggregate exposure might look like before you invest in the full analysis, our vCISO calculator gives you a rough sense of where you stand. For a deeper look at how to communicate this to your board, our FAIR board risk guide walks through the conversation step by step.

The vendors aren't going to get less risky. The question is whether you'll know your exposure — or discover it the hard way.