What is Shadow Liability - Where does it lurk, and how much does it contribute to 3rd Party Risk

Shadow Liability is defined as Risk that a company absorbs as a result of using 3rd party software, services or APIs. This is an especially tricky bit of liability to quantify accurately. Most organizations use a combination of vendor

(1) network and infrastructure vulnerability reports (ala Tenable type scans)

(2) security scorecard/bitsight type external opinion scores

(3) independent pen testing reports

(4) cyber-insurance policy coverage

(5) SOC2 type process oriented or more detailed FedRAMP style compliance reports

However a chasm …

cybersecurity liability party risk shadow