Why ‘Industry-Standard’ Vendors Still Create Hidden Cyber Risk

The slow drift of third-party exposure

A key lesson from the Mixpanel incident is that vendor risk is not static. Many analytics and monitoring tools rely on third-party JavaScript embedded directly into applications. Initially these scripts may be limited to basic telemetry but over time additional capabilities are often layered in including session replay expanded metadata collection or deeper behavioral tracking.

This gradual expansion is rarely malicious but it is often invisible to customers. Product teams are incentivized to collect more data and add features while security teams may only revisit vendor risk during periodic reviews. The result is a slow drift in data exposure that remains largely unnoticed until a breach occurs.

In the Mixpanel case analytics data collected through customer applications was exported into the vendor’s own environment. Once that environment was compromised attackers were able to access and export the data. The breach did not require compromising the customer’s core infrastructure only the trusted third party embedded within it.

Why vendor risk assessments fall short

The incident also highlights fundamental weaknesses in how organizations assess vendor security. Many vendor risk programs still rely heavily on self-attested questionnaires and point-in-time audits. These assessments are often completed by sales or compliance teams rather than engineers with direct insight into code-level behavior.

Even formal attestations such as SOC 2 reports provide only a snapshot of a vendor’s controls at a specific moment in time. They do not account for what changes months later when new scripts SDKs or data flows are introduced. In an environment where software changes continuously static assessments quickly lose relevance.

At the same time organizations continue to increase spending on internal security controls. Yet many of these investments focus on protecting infrastructure networks and cloud environments while overlooking what third-party code is doing inside the browser.

For attackers this imbalance is attractive. Directly targeting a hardened enterprise is difficult even for sophisticated adversaries. Targeting a downstream vendor with fewer defenses can be far easier and often yields access to valuable contextual data that can be leveraged for phishing social engineering or follow-on attacks.

The broader takeaway is not that organizations should abandon third-party tools but that traditional trust-based models are no longer sufficient. Vendor relationships must be treated as dynamic not fixed and security programs must account for how risk evolves after a tool is deployed. The Mixpanel incident serves as a reminder that widely trusted tools can quietly become sources of exposure when changes occur outside a customer’s field of view.