Third-party risk mitigation