Can CISOs at smaller enterprises wield enough influence to square the third-party security circle? Analysis