Turning the tide on third-party risk