Breach Risk Is Scored. Survival Risk Is Not.

Your third-party risk management program can tell you whether a vendor is likely to be breached. It cannot tell you whether that vendor will remain viable, invested, and strategically committed to the product you depend on in three years.

This is a gap in methodology, not execution. We have CVSS for vulnerabilities, SOC 2 for controls, penetration testing for technical exposure — an entire industry built around scoring breach probability. When the question shifts from "will they be breached?" to "will they still be building and supporting this product?" — the methodology stops. The questionnaires have no section for it. The risk register has no field.