vendor access risk