TL;DR: Late-2026 cyber risk is being reshaped by AI-assisted social engineering, supply-chain exposure and tighter regulation, with third-party involvement now cited at 48% of breaches and up 60% year over year, according to Cowbell. The practical issue is no longer annual review cadence but continuous risk governance across the policy lifecycle.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Cowbell's blog post: Late-2026 cyber risk is being reshaped by AI-driven social engineering, supply-chain exposure and regulatory pressure.
Why it matters: This matters because identity, access and third-party governance controls now have to keep pace with faster attack creation, broader dependency chains and shorter response windows.
By the numbers:
- Third-party and supply chain involvement now accounts for nearly half of all breaches at 48%, according to the 2026 Verizon Data Breach Investigations Report cited by Cowbell.
- Third-party and supply chain involvement rose 60% over the previous year, according to the 2026 Verizon Data Breach Investigations Report cited by Cowbell.
- The Cyber Security and Resilience Bill 2026 mandates strict 24-hour incident reporting, according to Cowbell.
Context
Cyber risk is becoming a governance problem, not just a security operations problem. AI-assisted phishing, supply-chain dependency and regulatory reporting pressure now move on different timelines, which means annual reviews and point-in-time questionnaires are no longer enough to describe real exposure.
For identity and access teams, the uncomfortable shift is that attackers increasingly exploit trust relationships rather than single systems. When vendors, MSPs, cloud services and human users all sit inside the same operational chain, weak offboarding, over-permissioned accounts and stale third-party access become business risk multipliers.
Key questions
Q: How should teams verify executive or vendor requests before approving them?
A: Teams should verify executive or vendor requests through a separate, trusted channel before approving them, such as a known call-back number, encrypted messaging on a registered account, or a workflow that requires dual approval. They should confirm the requester’s identity, authority, and the exact change requested, because spoofed email, deepfake voice, and hijacked vendor accounts are common fraud paths.
Q: Why do third-party access paths create so much NYDFS compliance risk?
A: Because the regulation holds the institution accountable for delegated access even when a vendor or partner operates the system. If access survives the business relationship, or if offboarding is not formalised, the organisation keeps the risk without the ability to prove control.
Q: What is continuous cyber risk governance?
A: Continuous cyber risk governance is the ongoing process of identifying, prioritising, tracking and evidencing cyber risks and controls as systems, threats and business changes occur. It ties risk decisions to asset inventories, control ownership, exceptions, remediation actions and metrics, so security teams and leaders can see current exposure rather than rely on periodic reviews.
A: Organisations should prioritise identity and authorization capabilities when remote work, SaaS sprawl, and expanding tech stacks make access control the main pressure point. If the security problem is who can reach systems and data, identity-centric controls often deliver faster risk reduction than adding more perimeter-focused tooling or point products.
Technical breakdown
AI-driven social engineering compresses the detection window
Generative AI changes the economics of fraud and intrusion by making impersonation cheaper, faster and more convincing. Instead of crude phishing, attackers can produce executive-style messages, vendor invoices and voice content that fit the target's normal workflow. That raises the success rate of first-contact abuse and reduces the time defenders have to distinguish genuine requests from synthetic ones. The control problem is no longer only message filtering. It is verifying intent, provenance and authorised business context before sensitive actions are approved.
Practical implication: Strengthen verification steps for payment, credential and vendor-change requests before they are actioned.
Supply-chain exposure turns third-party access into a shared attack surface
Modern SME environments extend beyond owned infrastructure into SaaS, MSP and cloud dependencies. That means compromise can enter through a partner account, a delegated integration or a trusted workflow rather than a directly exposed asset. The security question shifts from perimeter defence to governance of external trust. Identity controls matter here because third-party accounts, API credentials and support access often outlive the business reason they were granted, especially when offboarding is weak or inventory is incomplete. See the Identity Controls for Cyber Insurance Questionnaires Guide.
Practical implication: Inventory every third-party access path and remove trust relationships that no longer have an active business owner.
Continuous underwriting mirrors continuous risk governance
Static renewal processes assume risk is relatively stable across the policy term, but the article argues the threat surface changes too quickly for that assumption to hold. Continuous underwriting is effectively a governance model that revisits operational reality as systems, suppliers and attack conditions change. For security teams, the underlying lesson is familiar: controls that depend on annual attestations age badly when identity, cloud and supplier access change weekly or daily. Governance has to follow the lifecycle, not the renewal date.
Practical implication: Shift policy evidence, access reviews and control validation to a rolling cadence instead of an annual checkpoint.
Threat narrative
Attacker objective: The attacker aims to exploit trusted human and third-party processes to gain access, trigger fraud or widen the blast radius of an otherwise small initial compromise.
- Entry begins with AI-generated social engineering that mimics trusted executives, vendors or service providers well enough to win a first interaction.
- Credential or process abuse follows when the target approves a payment, shares a secret or grants access based on a fabricated trust signal.
- Escalation happens through the third-party chain when delegated access, MSP connectivity or cloud trust relationships provide a wider route into the environment.
- Impact is broader business loss, including fraud, breach exposure, regulatory friction and longer recovery because the attack used legitimate trust paths.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
AI has changed the trust test, not just the spam filter. The security problem is no longer whether a message looks suspicious to a human eye, but whether the organisation can prove the request belongs to a legitimate workflow. That shifts the control burden toward stronger verification for payments, vendor changes and credential resets. Practitioners should treat synthetic trust as a governance issue, not a user-awareness issue.
Third-party access is now an identity governance problem in disguise. When supply chains account for such a large share of breaches, the question is not only who owns the contract but who owns every account, token and delegated connection behind it. Identity controls for cyber insurance questionnaires matter here because offboarding, MFA scope and service-account inventory are no longer administrative details; they are exposure control points. Practitioners should map external trust paths to named owners and lifecycle dates.
Continuous risk management is replacing point-in-time assurance. Annual renewal logic assumes the environment is static enough for a yearly checkpoint to be meaningful. That assumption breaks when cloud dependencies, supplier access and attack methods shift weekly. The named concept here is renewal-window risk: exposure that changes materially between formal review moments. Practitioners should move evidence collection and control attestation onto a rolling cadence.
Regulatory pressure is pushing insurance and security toward the same operating model. A 24-hour reporting expectation forces organisations to know quickly what changed, what was exposed and which third parties were involved. That is only possible when identity, access and supplier records are current enough to support fast decisions. Practitioners should align incident response, insurance evidence and third-party governance to the same operational clock.
SMEs are being pulled into enterprise-grade governance faster than many realise. The combination of AI-assisted attacks, supplier dependency and regulatory scrutiny means smaller organisations now face control expectations once associated with larger regulated firms. That does not mean copying enterprise bureaucracy. It means prioritising the identity, access and third-party controls that most directly reduce loss severity. Practitioners should treat governance maturity as a resilience control, not a compliance chore.
What this signals
Renewal-window risk: exposure that changes between formal review moments is becoming the more useful planning concept for insurance, security and governance teams. The practical implication is that evidence, ownership and access data need to be current enough to support decisions at the pace of change, not just at renewal or audit time.
AI-assisted social engineering and supplier trust abuse are pushing small organisations toward a control model where verification happens at the moment of request, not after the fact. That means identity governance, vendor onboarding and exception handling need to converge around the same approval workflow.
The most useful operational question for practitioners is no longer whether a control exists, but whether it still reflects the current state of external trust. If supplier access, delegated credentials and approval paths are not continuously updated, attackers will keep finding legitimate routes into the business.
For practitioners
- Tighten verification on high-risk requests Require out-of-band confirmation for payment changes, password resets, new payees and vendor bank-detail updates before approval.
- Inventory third-party access paths Create a live register of MSP accounts, SaaS administrator roles, API credentials and support channels with named business owners.
- Shorten offboarding for external trust relationships Remove delegated access, dormant integrations and unused partner credentials as soon as the business need ends.
- Move to rolling evidence collection Refresh access evidence, supplier reviews and incident-readiness checks on a monthly or event-driven basis rather than waiting for renewal.
Key takeaways
- AI-assisted impersonation is making trust validation a core control problem for SMEs, not just a user-training issue.
- Third-party and supply-chain exposure is now a dominant breach path, which raises the importance of account inventory, delegated access governance and offboarding.
- Continuous review of access, supplier relationships and incident evidence is becoming more useful than annual insurance or security checklists.
Related NHI Mgmt Group resources: Identity Controls for Cyber Insurance Questionnaires Guide · Small Business Incident Response Guide · Small Business Identity and Access Security Guide · Sisense breach 2024
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001; TA0006; TA0008 — Initial Access; Credential Access; Lateral Movement | AI-assisted impersonation and trusted third-party access map to the attack stages described here. |
| Recommendation — Map supplier-led compromise and social engineering to these tactics and tune detection for trusted-path abuse. | ||
| NIST CSF 2.0 | GV.SC-01 — Supply Chain Risk Management Strategy | Supplier dependency is a central exposure driver in this market trends analysis. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post highlights over-broad and stale third-party access as a key control gap. | |
| Recommendation — Document and maintain a supply-chain risk strategy that covers delegated access and external trust paths. Review entitlements for third-party and MSP access on a rolling cadence and remove stale authorisations. | ||
| CIS Controls v8 | CIS-5 — Account Management | Third-party accounts and service access are recurring loss paths in this topic. |
| Recommendation — Inventory, review and revoke dormant external accounts and delegated credentials before renewal windows. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege directly addresses the excess access that amplifies third-party and SaaS compromise. |
| Recommendation — Restrict external and internal accounts to the minimum access needed for each business relationship. | ||
Key terms
- Supply Chain Risk Management: The practice of identifying, assessing, mitigating, and monitoring risk across suppliers and service providers. In regulated environments, it also includes evidence, traceability, and control ownership so organisations can defend decisions when external dependencies change.
- AI-Driven Social Engineering: AI-driven social engineering uses artificial intelligence to craft convincing messages, voices, images, or interactions that manipulate people into revealing secrets, approving actions, or bypassing controls. In cybersecurity, it combines generative content, behavioral profiling, and automation to scale phishing, impersonation, fraud, and credential theft across email, chat, voice, and other channels.
- Continuous Underwriting: An underwriting model that updates risk judgment as evidence changes instead of waiting for a scheduled renewal. It relies on recurring signals, event-driven review, and workflow automation so pricing and coverage reflect current posture rather than a stale annual snapshot.
- Third-Party Access: Third-party access is access granted to vendors, contractors, or support partners who are not direct employees of the organisation. It is higher risk than internal access because accountability, device assurance, and access duration are harder to control, so it usually requires tighter time limits and stronger auditability.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It is suitable for practitioners who need to connect identity controls to broader security and resilience decisions.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org