Third-party risk is exponentially expanding your threat surface 

While businesses are facing soaring threats to keeping operations active, traditional business insurance is abandoning them. This is where an 831(b) plan makes all the difference. 

Many businesses today fail to grasp the magnitude of the current third-party risk, despite news headlines pointing to outages and cyber-attacks that make their massive threat landscape clear.  

What makes this dreadful situation far worse is that most of these businesses don’t realize their financial exposure, being unaware that most third-party-caused operational downtime is excluded from reimbursement from traditional business insurance. That is why an 831(b) plan–where fellow business owners set most of the rules–is becoming essential. It will cover what those traditional plans won’t. 

What exactly is third-party risk? Traditionally, it refers to operational, cybersecurity, or privacy issues that originate not from your own employees, but from outside companies your business relies on. These third parties often provide essential services—such as cloud hosting, e-commerce platforms, or backup and disaster-recovery support—that keep your business running. 

In some ways, those disruptions can be traced back to your team, simply because your employees selected and hired those providers. But today’s third-party risk landscape has expanded far beyond direct vendor choices. It now includes risks created by your vendors’ vendors—companies you never evaluated, never approved, and may not even know exist. 

Let’s look at a simple example: Your team hires the Acme trucking company to distribute your product. Acme, in turn, relies on a major hyperscaler to host their systems. That particular hyperscaler (as in Microsoft, Google or AWS) is one that your company intentionally avoids because you believe it carries too much risk. 

If Acme uses that hyperscaler and it crashes, the trucking firm’s systems crash with it. Suddenly, the trucking company cannot function, and your product ends up stranded in a warehouse. 

Your team never selected that hyperscaler–nor were they even asked to approve that hire or most likely were never even told about it-and yet that is why your product isn’t moving. Your traditional insurance premiums will not likely protect you from this type of disruption, but an 831(b) Plan will. 

As bad as that sounds, the reality is frighteningly worse. Most companies are now dependent on a vast ecosystem of third parties, far more than they realize. 

Their database program may be hosted externally. If that provider crashes or any of their third-parties crash, your CRM program may stop working. SaaS is being deeply embedded into almost every product, including many that claim to be fully local.  

Last summer’s Crowdstrike outage is a perfect example. Because of a glitch that has yet to be fully explained, the software from this cybersecurity company didn’t simply crash. It crashed every Windows machine it touched.  

Here is where the real lesson shows up: during the first few hours of the global outage, major news outlets reported that only organizations using CrowdStrike, and only on Windows Systems, would be impacted. That turned out to be wildly inaccurate. Consider the travelers stranded in airports because critical systems went offline. Many of those people had never used CrowdStrike in their lives. Their employers lost revenue, missed meetings, and disrupted operations. Do you think their traditional insurance policies will compensate them for those losses? 

The ripple effect didn’t stop there. What about the businesses that depended on companies that relied on Crowdstrike?  

One large company recently discovered their third-party exposure from using a popular messaging program called Slack. That program leaked data about their most sensitive discussions. Think their traditional insurance will come to their aid? Highly unlikely.  

An oft-discussed topic among IT is board-level risk tolerance. Meaning that the owner(s) decides–for that business–how much risk they are willing to tolerate and, in theory, that dictates how much money they spend on cybersecurity, compliance programs and other defensive efforts.  

But risk tolerance only works if you truly understand the risks on the table. Today’s reality is that companies–due to rapidly expanding third-party exposures from third-party risks, sharply magnified by AI–have no idea what risks they are accepting.  

When negotiating with traditional insurance firms, business owners and executives who lack a full understanding of their exposures simply cannot secure meaningful protection. Sadly, even if they did know all of their current risks, it is unlikely they would be in a position to pay for the higher premiums and to avoid the exclusions. 

That is precisely why an 831(b) Plan is becoming essential, allowing a business to self-insure for risks not available through traditional insurance. By setting aside tax-advantaged dollars during strong years, the plan ensures business owners have the resources to stay whole when unexpected events strike. This is something to seriously consider as premiums go up and coverage decreases with traditional policies.