Third-party endpoint risk