From the news item to a re-assessment, sized to the vendor's tier

The first you hear of a vendor’s breach is rarely from the vendor. It is a news item, a post on a status page, or a colleague asking whether “that call-recording company” is the one you use. In the hour that follows, the same questions come up in every organisation: do we use them, what do they hold of ours, who in the business depends on them, and what do we need to do today? If the answers live in a spreadsheet, a contract folder and three people’s heads, that hour turns into a week.

This post follows one signal in the demo organisation, Northwind Labs: “Callwave confirms credential-stuffing incident affecting a small number of accounts”. It shows how the signal became a re-assessment, what the vendor record already knew, what to ask the vendor, and how the incident fed into a renewal decision due in December. Callwave is fictional, and so is the news item; in the demo, items from InsightPulse are marked as illustrative.

Why a vendor’s breach is your problem

When a vendor that holds your data is breached, the data is still yours. Your customers, your regulators and your board will ask what you knew about the vendor and what you did once you found out. Depending on the data and where you operate, you may have your own notification duties: under the EU General Data Protection Regulation (GDPR), a controller generally must notify the supervisory authority within 72 hours of becoming aware of a personal-data breach, and New York’s cybersecurity regulation (23 NYCRR 500) sets its own notification and third-party requirements for covered entities. Confirm the obligations that apply to you with your compliance and legal teams.

Speed matters for cost as well as compliance. The longer it takes to understand exposure, the longer credentials stay valid, integrations stay open and staff keep uploading data to a service that may not be safe.

The signal: a credential-stuffing incident

Credential stuffing is an attack in which usernames and passwords leaked from other services are tried against a login page at scale, succeeding wherever people have reused a password. It is not necessarily a breach of the vendor’s infrastructure; it is a breach of accounts. That distinction shapes the questions you ask: whether the vendor’s core systems were affected matters less than whether any of your accounts were among the “small number”, and whether those accounts could have been protected by single sign-on and multi-factor authentication.

The signal arrived through InsightPulse, the company-intelligence and news feed, and landed on Callwave’s record and in the monitoring feed. Signals come in several kinds — breach, sanctions, adverse media, financial, certificate, domain, document expiry, portal silence and news. This one is a breach signal.

The reaction, sized to the tier

Not every signal deserves the same response. A breach at a Tier 4 design agency is worth a note; the same headline about a Tier 1 hosting provider may need an escalation the same day. The Monitoring agent runs at L3, “Act and tell”: it chooses the reaction from the signal kind and the vendor’s tier, applies it, tells the owner, and the choice can be pulled back.

The possible reactions are note, finding, re-assessment and escalation. The mapping shown is illustrative; the customer sets it.

Callwave is Tier 2 High, so the reaction was a re-assessment. That reopens the vendor’s review: a targeted questionnaire, a check of the evidence on file, and a fresh risk score once the answers are in. It is more than a note in a log and less than an emergency, which is about right for an account-level incident at a vendor that is important but not critical.

What the vendor record already knew

The point of a vendor record is that, when a signal arrives, nobody has to go looking. The Callwave 360 answers the first-hour questions:

Question	From the Callwave record
Do we use them?	Yes. Sales call recording, Tier 2 High, about $64k a year
What do they hold?	PII and customer data: recorded calls with prospects and customers
Who depends on them?	31 Northwind users; the owner and contacts are on the relationship tab
How risky were they already?	Residual risk 100 against an inherent 65, with 21 findings
What is already wrong?	A critical “No data privacy or data processing obligations” in the MSA; “OpenAI listed as sub-processor — AI data exposure risk” in the DPA
When can we leave?	Contract notice due 14 December 2026

Two existing findings matter more now than they did yesterday. If the master services agreement (MSA) carries no data-processing obligations, Northwind’s contractual footing to demand information about the incident is weaker than it should be; the data processing agreement (DPA), if it is incorporated, is where those duties will be found. And if call data flows to a model provider as a subprocessor, the question “what could an attacker with account access see?” may include transcripts and summaries, not only recordings.

What to ask the vendor

Vague questions get vague answers. A re-assessment after a credential-stuffing incident should ask for facts you can act on. These are the questions we would put to Callwave; adapt them to your own vendor and incident:

Ask	Why
Were any Northwind accounts among those affected? Which users, and when?	Determines whether this is your incident or only theirs
What could an affected account see or export: recordings, transcripts, contacts, integrations?	Sizes the exposure of PII and customer data
How was it detected, and how long were the accounts accessible?	Tells you how good their monitoring is
Is SSO enforced for our tenant, and is MFA available or required for local logins?	Credential stuffing fails against enforced SSO and MFA
What has changed: rate limiting, breached-password checks, forced resets?	Shows whether the root cause is addressed
Was any data sent to subprocessors, including model providers, from affected accounts?	Connects the incident to the existing DPA finding
When will you confirm in writing, and under which contractual clause?	Tests the notification obligations you actually have

The questions go to Callwave’s contacts through the vendor portal, by signed link with no account to create. Like every message an agent writes, the invitation and any follow-up are held in the outbox until a person releases, edits or cancels them. During an incident that matters: the wording of a message to a vendor may later be read by lawyers on both sides.

From signal to answers to a renewal decision. Both outbound steps wait for a person.

What to do inside your own walls

Some of the response is not about the vendor at all. While Callwave answers, Northwind’s own teams can act on what the vendor record tells them. These are steps for people and your own tools; InsightVendors tells you who and what is involved, it does not reset passwords for you:

The renewal decision afterwards

Incidents rarely change a vendor relationship on the day. They change it at the renewal, if anyone remembers. Callwave’s contract notice is due on 14 December 2026, about five weeks away at the time of writing. The Renewal agent works ahead of every notice date and assembles spend, risk trend, open findings and the date into a recommendation: renew, renegotiate or offboard.

For Callwave it proposed offboard, with the reason “Residual risk is 100 (critical) with 8 high/critical finding(s) open”. The Renewal agent runs at L1, “Draft”: it prepares the recommendation and a person makes the call. A reasonable owner might still renew if Callwave fixes the MSA, confirms Northwind accounts were untouched and enforces SSO; the recommendation is the starting point for that conversation, not the end of it.

If Northwind does offboard, the offboarding checklist covers what is easy to forget under pressure: access revoked, data returned or deleted with a certificate of destruction, the contract terminated and the supplier closed.

What it adds up to

For the CISO, the first hour is spent deciding rather than searching: the vendor’s data, users, findings and contract are on one page when the signal lands. For the vendor-risk lead, the reaction is proportionate by rule and the questions are specific. For the board, the incident is tied to a decision with a date — renew on better terms, or leave before notice passes.

Keep reading