A vendor-managed platform is a system that a supplier operates for a customer organization. The vendor may host the software, administer accounts, manage updates, store documents, or handle support workflows, while the customer relies on it for business operations. Because the supplier controls part of the environment, the customer does not always have direct visibility into every action, log, or access path.
In cyber security, this matters because a vendor-managed platform creates a trust boundary outside the customer’s own network. If the platform is overprivileged, poorly monitored, or exposed through weak authentication, attackers may steal data, abuse support functions, or move through shared workflows to reach sensitive records. Defenders reduce this risk with least-privilege access, strong vendor due diligence, logging, segmentation, encryption, and rapid revocation of supplier access. The key question is not just whether the customer’s systems are hardened, but whether the vendor’s operational role is tightly limited and continuously observed.