Supplier dependency is the reliance of an internal service on an external provider, platform, or managed service to keep working. The dependency may involve cloud infrastructure, identity services, software updates, support contracts, or outsourced operations. It matters because the security and availability of the internal service are only as strong as the weakest supplier link.
In cyber security, supplier dependencies expand the attack surface beyond the organization’s own network. A compromise of a vendor account, API, update channel, or shared platform can disrupt access, expose data, or become a path into downstream systems. Defenders manage this risk by mapping dependencies, assigning owners, checking supplier controls, and planning for outages or exit strategies. Clear dependency records also improve incident response, because teams can quickly identify which services may fail if a third party is unavailable or breached.