Why third-party providers pose a security risk to organizations