The Power of Three: Why Cybersecurity Doesn't Stop at a "One-Two"…

That’s what I want to make a case for in this article: oversight doesn’t always get the attention it deserves. Many companies have been working with the same IT partner for years. Trust has been built, problems are resolved before they become apparent, and the IT environment runs as it should. So why look any further? Yet in practice, I’ve noticed that this can give rise to risks. Not because the IT partner isn’t doing its job well, but because cybersecurity has become such a complex topic that one important question is often overlooked: who checks to make sure that everything being implemented still aligns with today’s risks?

The importance of such checks is illustrated, for example, by an article in Beveiligingsnieuws* that describes how 150 municipalities were hit by ransomware because they relied on outsourced IT services. What I know for certain is that there are many more examples that never make it into the media. We mainly hear about attacks on big-name companies, such as Odido, Basic-Fit, and Booking.com.

The IT partner ensures a stable working environment, sets up backups, implements security measures such as multi-factor authentication, manages systems, and keeps the environment up to date. Exactly as you would expect. But no matter how well those services are organized, they never guarantee that risks are fully visible or that all security measures actually do what they’re supposed to do. Do the security measures still align with the organization’s current risks? And have new vulnerabilities or changes in processes been factored into how the environment is secured? The answer to many of these questions should be yes. However, figuring out exactly which questions to ask has become more challenging.

An IT partner’s goal is almost always the same as that of the client: to ensure a secure and reliable environment. Ultimate responsibility lies with the client, but at the same time, this often requires close collaboration. However, no professional can fully review their own work. Not because there is mistrust, but because an independent perspective simply provides different insights. That is why I personally believe that “one-on-ones”—the client-vendor relationship—are more necessary than ever today:

The power of three!

I’d like to highlight this valuable model: the customer, the IT provider, and a third party are all aware of each other’s responsibilities and reinforce one another. Because there is sometimes confusion during my meetings with customers about who plays which role and what each party does, I’ve laid it all out:

The First Line
This refers to the organization itself. Here, decisions are made regarding processes, systems, and applications, as well as how they are used securely. The first line is responsible for the day-to-day use of these resources and for managing the associated risks. The guiding principle is that the IT and security infrastructure should align with the way your organization operates and fit your strategy.

Second-line support
This level focuses on the operational management and maintenance of the IT environment. This responsibility often lies with the internal IT department or is handled by a Managed Service Provider (MSP). This includes system administration, monitoring, patch and update management, user management, backups, and resolving technical incidents. The goal of second-line support is to ensure that the IT environment remains secure, stable, and available.

The third line, as a supervisory function
The third line operates independently of day-to-day operations and IT management. From an objective perspective, this line assesses whether processes, systems, and control measures are actually set up effectively and function as intended. It is precisely this independent assessment that reveals what is often overlooked in practice, because organizations and administrators are naturally closely attuned to their own environment.

Ultimately, we all share the same interest: being able to trust that everything works securely. In this context, the third line is not intended to act as an “auditor of the IT partner,” but rather as a complement to the existing partnership. While an IT provider often focuses primarily on technology, availability, and management, the third line takes a broader view of information security as a whole: the interplay between people, processes, and technology. Personally, that’s also what makes my work so interesting.

At OneXillium, we are happy to fulfill this independent role. In this way, we help organizations and their IT partners work together to create a secure, resilient, and future-proof environment.