>must include the vendor as a threat

Or anyone who gets access to the vendor's database.