Vendor Contract Security Obligations and Flow-Down
The Kaseya VSA incident reached roughly 1,500 businesses through 50 to 60 providers, none of whom used the compromised product directly. Vendor contract security obligations are how requirements reach that far.

