> You don't need to manage the security for a large application, instead, the responsibility is distributed to each API. Wrong. Third-Party risk management is

> You don't need to manage the security for a large application, instead, the responsibility is distributed to each API. Wrong. Third-Party risk management is your responsibility as a service provider. Your customers will want to know what kind of services your application depends on. I would recommend being very thorough in deciding who you will partner with and send data to. If you are a small startup, it most likely doesn't matter, but once you start getting serious business opportunities then data governance is the game.