Nth-party risk is the security risk that comes not from your direct supplier, but from that supplier’s suppliers, and the vendors behind them. In practice, it describes hidden dependency chains: a SaaS provider may rely on a cloud host, an outsourced developer, or an open-source package maintainer that you never contract with directly. This matters because a weak link farther down the chain can still affect your data, availability, or software integrity, even when your own vendor looks well controlled.
Attackers often exploit this layer by compromising a managed service, build pipeline, library, or subcontractor to reach many downstream customers at once. Defenders reduce nth-party risk by mapping critical dependencies, asking suppliers about their own vendors, reviewing SBOMs and hosted services, and monitoring for changes in third-party posture. In other words, direct vendor risk management is not enough if the real exposure sits two or three steps away.