Attackers use island hopping attacks by compromising a trusted partner, supplier or subsidiary and then moving through its relationships to reach the real target. They exploit shared access, interlinked networks and delegated trust to bypass direct defences. Organisations should map third-party connections, restrict privileges, segment access and monitor unusual cross-organisational activity.
How island hopping attacks work across trusted relationships
Island hopping is attractive because it turns a trust relationship into an access path. Rather than attacking the final target directly, the adversary compromises a partner or subsidiary that already has connectivity, permissions or operational familiarity, then reuses that position to pivot farther into the target environment. The core weakness is not just compromise, but the trust chain that makes the compromise useful.
That is why these attacks often blend technical intrusion with relationship abuse. A supplier may have remote access, shared identity paths, support tooling, file exchange channels or intercompany network links that are legitimate on their own but dangerous when combined with attacker control. The attack succeeds when defenders treat the partner as trusted by default instead of continuously verifying the actual access path.
In practice, island hopping is often a lateral movement problem that crosses organisational boundaries. Lateral Movement Guide is useful because the same techniques that move an attacker inside one network can also be used to pivot from a compromised third party into the real target, especially when shared credentials or remote services are involved.
Why delegated trust and third-party access make the attack viable
The attack works when third-party relationships are allowed to become standing access paths. Shared networks, federated access, remote administration, file transfer routes and integrated business systems can all become stepping stones if they are not segmented and tightly scoped. The more the partner can touch, the more valuable it becomes as an intermediate target.
Attackers usually look for the easiest reachable island with the best downstream connections. That might be a managed service provider, a regional subsidiary, a contractor with broad support privileges or a less mature vendor with weaker monitoring. Once inside, they use legitimate-looking relationships to avoid triggering direct perimeter defences at the real target.
The broader third-party control problem is that your security depends on someone else’s hygiene as well as your own. NHIMG’s Third-Party Risk Management Guide covers the lifecycle controls that matter here, including vendor tiering, due diligence, contract security clauses, continuous monitoring and offboarding, all of which reduce the chances that a partner becomes the easiest bridge into your environment.
Because the compromise often starts outside your perimeter, defenders need visibility into supplier links, not just their own assets. That means understanding who has access, how far that access reaches, what systems are reachable through it and whether the relationship still needs to exist in the current form.
What defenders should watch for when a partner becomes the pivot point
Island hopping rarely looks like a single dramatic event. It often appears as a sequence of ordinary actions from an unusual origin: a supplier account reaching new systems, a partner connection used at an odd time, remote support activity that does not match the expected business process, or lateral movement that crosses from one administrative domain into another.
Cross-organisational activity is especially important when it involves identity reuse, remote tools or shared administrative channels. If the first compromise is detected quickly, the next question is whether the attacker has already used that foothold to enumerate other connected environments, harvest credentials or abuse trust relationships that were never meant to be broad attack conduits.
A useful operational habit is to treat “external but authorised” activity as a monitored condition rather than an inherently safe one. The issue is not simply whether the partner was allowed in, but whether the observed pattern matches the minimum necessary use of that access and whether the access path can be constrained before it is abused again.
Risk and Threat Considerations
Island hopping turns one compromise into a multi-organisation intrusion path, which means the blast radius can extend well beyond the first victim. The main risk is trust propagation: once attackers control a connected partner, they can leverage legitimate access paths to bypass direct defences, steal data or reach high-value environments that were never exposed to the internet.
Failure mechanism: Shared access, overlapping administration, weak segmentation and excessive partner permissions allow an initial compromise to be reused as a bridge into the target. The defender fails when trust is granted to the relationship itself instead of to each request, system and session.
Impact: A supplier breach can become a downstream breach of the real target, with credential theft, unauthorized access, data exposure and broader operational disruption that may spread across multiple businesses at once.
Practitioner Guidance
What to verify: Confirm which partner connections are actually necessary, which ones still exist only for legacy reasons, and which accounts or channels can reach production systems without additional checks. If you cannot describe the business purpose of a cross-organisational path, it is probably too broad.
Decision rule: If a third party can reach sensitive systems through standing permissions, treat that path as a high-risk dependency and reduce the reachable surface before relying on detection alone. If the connection is essential, narrow scope, segment the route and watch the resulting activity much more closely.
What good looks like: Partner access is limited to the smallest practical set of systems, time windows and administrative functions, and unusual movement between organisations is visible in logs and investigations rather than hidden inside normal support traffic.
Practitioner takeaway: Island hopping is best countered by shrinking the trust bridge, not by assuming the bridge will never be used. If a partner can become an entry point, it should also be treated as a monitored attack surface.