Many organizations assume contracts or insurance transfer third-party cyber risk until a disruption proves otherwise. Limiting financial fallout requires treating third-party exposure as a capital and resilience issue, with direct implications for earnings, cash flow and balance sheets. Effective cyber risk management means quantifying financial impact from third-party incidents to inform the appropriate risk mitigation, transfer and retention strategies.