Companies are securing their own infrastructure more and more, making direct attacks on their own infrastructure nearly impossible. Therefore, attackers are choosing the route via third-parties, which do not have the required resources to prevent attacks on their cyber-infrastructure. Numerous examples of cyberattacks in the last years clarify the significance of the inclusion of a third-party security perspective. The severe direct and indirect consequences of such a cyber-attack include ransom demands, reputational damage, publication of confidential data, and long-lasting business interruptions with a corresponding loss of revenue.