But doing so could be risky, should said vendor be subject to a data breach, which is why HR leaders need to be more choosy ...