How should insurance carriers strengthen third-party risk management when vendor security is weaker than their own?

Insurance carriers should treat supplier security as an extension of their own attack surface, not a separate compliance exercise. The practical response is to identify the vendors with the highest exposure, continuously monitor their security posture, and prioritize remediation paths for the relationships most likely to be used as entry points. Strong internal controls do not offset a weak supplier chain if access paths remain open.

How insurers should reframe third-party risk

When a carrier’s internal controls are stronger than a vendor’s, the right unit of analysis is the relationship, not the supplier’s questionnaire score. The practical question is whether the vendor creates an externally reachable path into claims data, policy systems, payment rails, or identity trust relationships. If it does, that path deserves the same attention as a first-party control gap, especially where OAuth apps, API keys, or shared integrations are involved.

That is why supplier risk should be mapped to exposure, not just contract language. Weak monitoring, over-privileged access, and stale credentials are the conditions that turn a routine integration into a security dependency. For a broader NHI perspective on those patterns, see Ultimate Guide to NHIs and Top 10 NHI Issues.

What to tighten first in a weaker-vendor environment

Start with the relationships that can actually be used to enter your environment, not the longest vendor list. That means inventorying connected third parties, ranking them by data sensitivity and access scope, and then checking whether each integration has a clear owner, a bounded purpose, and a revocation path. Where the vendor is already weaker than your own baseline, the fastest value usually comes from narrowing scope and removing standing access rather than waiting for the supplier to “improve.”

In practice, the strongest controls are the ones that reduce blast radius: short-lived credentials, minimum necessary permissions, separate environments for testing and production, and active logging on every sensitive integration. The current visibility gap is still large, with The State of Non-Human Identity Security reporting that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps. That is a reminder that “approved vendor” is not the same as “controlled vendor.”

Risk and Threat Considerations

A weak supplier becomes dangerous when its access is broader than its security maturity. The main failure mode is not just breach at the vendor, but trusted access being abused to pivot into the carrier’s own systems, especially through API tokens, OAuth grants, service accounts, or unmanaged integrations.

Failure mechanism: Excessive permissions, poor monitoring, and delayed revocation let an attacker turn a third-party relationship into a durable entry point or lateral movement path.

Impact: The carrier can absorb the vendor’s control weakness as a direct compromise risk, including data exposure, fraudulent activity, and disruption in customer-facing workflows.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST Zero Trust (SP 800-207) set the technical controls, and DORA define the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.1 — Cybersecurity Risk Management Strategy	Third-party exposure must be governed as part of enterprise cyber risk.
	ID.IM — Identity Management, Authentication, and Access Control	Weaker vendors often create access paths that need tighter control and revocation.
Recommendation — Classify critical vendor connections by business impact and risk appetite. Tighten and verify access scope for every third-party integration.
CIS Controls v8	6 — Access Control Management	Vendor relationships become risky when external access is broad or poorly revoked.
	15 — Service Provider Management	Insurance carriers rely on external providers whose security posture must be managed.
Recommendation — Restrict, review, and revoke third-party access on a defined schedule. Assess providers against required controls and track remediation commitments.
DORA	ICT third-party risk management — ICT Third-Party Risk Management	Financial entities must control and oversee third-party ICT dependencies and exposures.
Recommendation — Contractually and operationally govern critical third-party ICT dependencies.
NIST Zero Trust (SP 800-207)	1 — Identity	Zero Trust requires every access path to be explicitly trusted and continuously evaluated.
	2 — Devices	Third-party access often arrives through managed or unmanaged endpoints that need validation.
	3 — Networks	Supplier connections should be segmented so compromise does not spread laterally.
Recommendation — Treat vendor access as continuously verified, not implicitly trusted. Validate the access device and its posture before allowing sensitive vendor connectivity. Segment vendor connectivity to limit lateral movement and blast radius.
OWASP Non-Human Identity Top 10	NHI-03 — Discovery and Inventory	Third-party integrations often hide the true set of identities and tokens in use.
	NHI-04 — Credential Rotation	Weak vendors are especially dangerous when tokens and keys remain valid too long.
Recommendation — Inventory all vendor-connected identities, tokens, and integrations. Rotate third-party credentials frequently and revoke unused access.

Practitioner Guidance

What to prioritise: Put every critical vendor through a simple decision rule, if the relationship can authenticate into production or touch regulated data, treat it as a high-risk access path and reduce scope before you negotiate broader assurance language. The most effective remediation is often access reduction, not more attestations.

What to verify: Require an owner for each integration, confirm that credentials can be rotated or revoked without vendor cooperation delay, and verify that monitoring captures token use, privilege changes, and unusual access patterns. If you cannot evidence those three points, the relationship is not yet being governed as part of your attack surface.

Practitioner takeaway: Strong internal security only helps if the supplier connection is constrained to the same standard, otherwise the vendor becomes the easiest way around your better controls.