Vendor sprawl is the gradual growth of many suppliers, SaaS platforms, cloud services, and managed tools across an organization. It usually starts with sensible decisions: a team buys a point solution, another unit signs up for a separate platform, and a third outsources a function to move faster. Over time, the environment becomes fragmented and harder to govern.
In cyber security, vendor sprawl matters because every additional supplier adds identities, integrations, data flows, contracts, and support paths that must be tracked. If ownership is unclear, access reviews, offboarding, patching, logging, and incident response can all break down. Attackers benefit from this confusion by exploiting forgotten accounts, weak third-party access, or exposed integrations. Defenders reduce risk by maintaining a current inventory, mapping dependencies, standardizing procurement, and regularly removing redundant services.