One of the challenges facing the third party risk community is the inability to gauge the risk of small vendors, those with only 2 to 100 employees. They are hot targets for hackers due to their access to large organizations’ sensitive data as well as their lack of IT resources.