Search papers, labs, and topics across Lattice.
This paper analyzes the implications of third-party vendor relationships on cybersecurity governance, using the November 2025 OpenAI-Mixpanel security incident as a case study. It introduces the concept of transitive trust, highlighting how customer trust in a service provider is contingent upon the security practices of their vendors, which are often opaque. The Fortress and Gatekeeper framework is proposed to elucidate the governance boundaries in cybersecurity, emphasizing the need for enhanced accountability and data management strategies in vendor relationships.
Customer trust in digital services hinges on the often-invisible security practices of third-party vendors, revealing a critical gap in cybersecurity governance.
Third-party vendors, such as analytics platforms, cloud services, identity providers, and software suppliers, are increasingly embedded in digital service delivery. While these arrangements enable scale and specialization, they also move customer data and security-relevant practices into environments that customers rarely see, select, or evaluate. This paper examines this problem through a document analysis of the November 2025 OpenAI-Mixpanel security incident. The incident serves as an illustrative case for showing how a security event in a vendor environment can become a governance and accountability problem for the focal organization that maintains the customer relationship. Drawing on organizational trust research and agency theory, the paper argues that third-party cybersecurity risk is both a trust relationship and a delegation problem. Customers trust the visible service provider, while the provider relies on vendors whose security practices are only partially visible and controllable. The paper develops the concept of transitive trust, where customer trust in a digital service depends on the security practices of vendors authorized by that service provider. It then presents the Fortress and Gatekeeper framework, which explains cybersecurity governance boundaries through trust and data flows rather than formal organizational ownership alone. The analysis develops four propositions concerning vendor integration, metadata exposure, vendor assurance, and data proliferation. The paper contributes to cybersecurity governance scholarship by explaining how delegated data processing creates customer-facing accountability and by identifying implications for vendor tiering, data classification, contractual design, continuous assurance, and data minimization.
