Meeting cyber-risks from third parties head on