/

Blog

Risks from third parties developing internal tools

When an outside firm builds or maintains an “internal” app, that firm is a third party. Still, it often never goes through vendor review. This case study shows what that looked like at one company, how we found it and the steps that close the gap.

When an outside firm builds or maintains an “internal” app, that firm is a third party. Still, it often never goes through vendor review. This case study shows what that looked like at one company, how we found it and the steps that close the gap.

November 5, 2026

Introducing Agentic Custom Reporting in Lema

Create custom TPRM reports in Lema using plain language. Refine reports through conversation, save them for your team, and export as PDF.

PHP2Shell: Your Entire Vendor Portfolio Could Be at Risk. Where Do You Start?

PHP2Shell puts your vendors and you at risk. Learn which PHP versions are affected, why remediation could take months, and how to prioritize your vendor response.

Introducing Third-Party AI Governance

Vendors add AI after you approve them, and employees adopt AI tools that never reach review. Learn how Lema's AI Governance discovers third-party AI, assesses its exposure, and surfaces where actual usage has drifted from the approved state.

Your TPRM Program Just Got a Lot More Accessible

Lema's MCP server connects your vendor risk data directly to Claude, Cursor, or any MCP-compatible AI tool. Learn how querying assessments, monitoring alerts, and vendor status in plain language replaces manual exports and report prep.

Lema AI Recognized as a Sample Vendor in Two Gartner® Hype Cycle™ Reports

Gartner recognized Lema AI as a Sample Vendor in two 2026 Hype Cycle reports. See what it signals for continuous third-party risk monitoring.

Your Vendors Are Using AI on Your Data - And You Probably Don't Know It

Shadow AI has become one of 2026's fastest-growing third-party risk vectors. See why unsanctioned AI tools are really unvetted sub-vendors, and the five questions every TPRM program should be asking now.

Why Third-Party Risk Management Programs Don’t Actually Reduce Risk

Enterprises have spent years building third-party risk programs around evidence collection: security questionnaires, audit reports, and penetration tests. Yet when a vendor gets breached, security teams still struggle to answer the question that matters: what exposure did that vendor actually create inside the environment?

OSINT Recon: Dynamic Threat & Exposure Monitoring

The Gap in AICPA Peer Review for New CPA Firms

Learn about the AICPA peer review gap where new CPA firms appear compliant to the SOC 2 market before their initial review is due.

What Vendor Risk Teams Can Learn from the Vercel Breach

What the Vercel breach reveals about shadow IT, fourth-party risk, and OAuth scope drift, and what TPRM programs need to address today.

How to Detect a Fraudulent SOC 2 Report

SOC 2 reports can be fabricated. Learn four concrete red flags — from unverifiable auditors to mismatched infrastructure — that distinguish a real audit from a fake one.

Training AI to Think Like an Attacker: The Red Team Approach to Risk Engineering

A guide to evolving TPRM using AI that simulates attacker behavior to identify vulnerabilities and architect secure vendor connections rather than relying on audits.

Checkbox TPRM is Dead. Start Engineering Risk

Traditional TPRM fails with vendor sprawl. Discover why compliance theater must stop and how Risk Engineers analyze real threats instead of checking boxes.

What is a Risk Engineer?

I've spent my career as an elite security researcher hunting vulnerabilities. My job has always been to think like an attacker: find the gaps and exploit the loopholes.

Building Agentic TPRM: A Guide

Learn the real architecture behind forensic risk engines — orchestration, risk graphs, adversarial agents, and continuous vendor risk monitoring.