TL;DR: Supply chain attacks increasingly turn trusted third parties into access paths, and Saviynt points to the Sisense breach as an example of how delegated trust can spread through identity and integration layers. The governance gap is no longer perimeter defense, but control over who and what can act through third-party access.
At a glance
What this is: This analysis argues that major supply chain attacks are now an identity governance problem because third-party access can become the real path into enterprise systems.
Why it matters: IAM, IGA, and PAM teams need to treat delegated trust, third-party entitlements, and account offboarding as part of supply chain risk, not separate control domains.
Context
Supply chain attacks are no longer only a vendor risk problem. They become an identity governance problem when third-party access, machine credentials, and delegated trust outlive the business relationship that created them.
In this context, identity governance must expand beyond human joiner-mover-leaver workflows to cover non-human identities, partner access, and the offboarding of external entitlements. The article uses the Sisense breach and related supply chain incidents to show that exposure can move through integration layers even when the original compromise is outside the enterprise boundary.
For IAM and IGA teams, the key issue is not simply who is logged in. It is who can still act on behalf of the enterprise, its vendors, or its customers after trust has been delegated.
Key questions
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed. Without continuous review, teams rely on outdated certifications that do not reflect live permissions. The result is uncontrolled delegated access, especially across SaaS and OAuth-connected systems.
Q: Why do vendor credentials create such a large supply chain risk?
A: Because they often grant authenticated access that bypasses normal perimeter checks and can persist across many connected services. A single credential may reach multiple systems, which means compromise can spread through legitimate trust rather than noisy exploitation. The larger the integration graph, the larger the blast radius.
Q: What are the signs that third party identity management is breaking down?
A: Common warning signs include orphaned accounts, access that is never revoked, no succession process when managers change, and no central view of vendor, supplier, or contractor risk. Another red flag is scattered sponsorship across the business, which makes reviews inconsistent. When teams cannot answer who owns access or why it exists, identity governance is already failing in practice.
Q: How should organisations respond when a supply chain identity path is compromised?
A: Organisations should contain the compromise by revoking the affected third-party identity, inventorying adjacent integrations, and verifying whether the same access pattern exists elsewhere. The response should also include recertifying partner entitlements and checking whether machine credentials or support channels outlived the original relationship. The goal is to stop delegated trust from remaining silently active.
Technical breakdown
Delegated trust becomes an access path
Supply chain compromise often starts with legitimate third-party access rather than direct intrusion. Once an external account, token, or integration is trusted, the attacker does not need to break authentication in the usual sense. They can move through the permissions already granted to the supplier, integrator, or service account. That makes the governance question one of trust scope, lifecycle, and revocation, not just credential strength. In practice, the enterprise must understand which non-human identities and partner accounts can reach production systems, data stores, and support channels.
Practical implication: Map every third-party access path to a named owner, expiry condition, and revocation trigger.
Why third-party identity sprawl widens blast radius
Third-party risk becomes harder to contain when access is distributed across support tools, SaaS integrations, CI/CD systems, and shared tokens. Each of those paths can become a separate governance blind spot if it is not inventoried and recertified. The issue is amplified when vendors reuse identities across customers or when their access persists after project completion. That is why supply chain incidents often look like identity failures at the point of impact: the attacker is not exploiting one perimeter control, but a mesh of retained privileges across organisations.
Practical implication: Reconcile vendor identities and service accounts across all connected systems before they become persistent blast-radius multipliers.
Offboarding is the control that fails last
In supply chain scenarios, the hardest failure is often not initial compromise but delayed offboarding. When partner access is not revoked promptly, a relationship that should have ended remains a live authorisation channel. This is especially dangerous for non-human identities because service accounts and integration credentials can continue working silently long after a vendor engagement changes. The result is governance drift: access still functions, but accountability no longer exists. That is why lifecycle control becomes a supply chain control, not an administrative afterthought.
Practical implication: Tie third-party access reviews to contract termination, environment decommissioning, and credential revocation events.
Threat narrative
Attacker objective: The attacker aims to convert legitimate third-party trust into persistent access that can be used to reach downstream systems and data.
- Entry occurs through a trusted third-party identity, token, or integration rather than through a public-facing perimeter.
- Credential access is then achieved by abusing the permissions already granted to the supplier or service account.
- Impact follows when that delegated access reaches customer data, support systems, or adjacent connected environments.
Breaches seen in the wild
- reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
- Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance has become a supply chain control surface. Major supply chain attacks now succeed when organisations treat third-party access as procurement risk instead of active identity risk. The Sisense example shows that delegated trust can become the most direct route into enterprise systems. Practitioners should therefore treat partner access as part of the identity security programme, not as a separate vendor-management exercise.
Third-party identity sprawl creates a hidden blast radius. The problem is not only that external parties are connected, but that they are often connected through multiple overlapping identities, tokens, and support paths. Once those paths are not centrally governed, the same compromise can propagate across several systems and customer environments. The practical conclusion is that blast-radius reduction now depends on identity inventory across organisational boundaries.
Vendor offboarding is a missing governance assumption. Traditional identity lifecycle models assume access is removed when the relationship ends. That assumption fails when partner accounts, API keys, and integration tokens continue to function after the business context has changed. The implication is that lifecycle governance must be redefined to include external trust termination, not just employee leaver processes.
Supply chain resilience requires control over delegated authority, not just perimeter defence. Perimeter monitoring cannot compensate for over-retained third-party permissions inside trusted systems. A modern IGA programme has to answer who can act, on whose behalf, and for how long across every non-human and external identity. Practitioners should reframe supply chain resilience as a continuous authorisation problem.
Delegated trust debt: the longer third-party access remains active after onboarding, the more governance debt accumulates in the environment. That debt is paid down only when access scope, ownership, and revocation are enforced as living controls. For practitioners, the lesson is that the riskiest trust is often the trust that no one is actively managing.
From our research library:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Third-party identity governance now sits inside supply chain resilience. If external access is not inventoried and recertified, the enterprise can lose control of who is acting on its behalf even when the original supplier is the compromised party. That is why identity lifecycle management has become a supply chain control, not just an access administration task.
Delegated trust debt: the longer vendor and integration access remains active, the more hidden exposure accumulates across connected systems. Practitioners should expect the biggest gaps to appear in offboarding, ownership, and entitlement review rather than in initial authentication. A supply chain programme that ignores those controls will miss the place where trust actually fails.
For practitioners
- Inventory every third-party identity path Build a single register of vendor accounts, service accounts, API keys, and support integrations that can reach production or sensitive data.
- Bind access to contract and task boundaries Require explicit expiry conditions for partner access so permissions end when the relationship, ticket, or deployment window ends.
- Recertify external entitlements separately from employee access Run distinct reviews for third-party users and non-human identities because their lifecycle, ownership, and offboarding triggers differ from human accounts.
- Revoke shared integration credentials on relationship change Treat vendor churn, environment migration, and support handoff as revocation events for tokens, certificates, and other machine credentials.
- Measure blast radius across connected environments Track how many downstream systems each third-party identity can reach so you can prioritise the accounts that turn a small compromise into a broad incident.
Key takeaways
- Supply chain attacks increasingly exploit trusted third-party identities rather than only public-facing targets.
- The most important evidence in this article is that 92% of organisations expose NHIs to third parties, which makes delegated trust a broad governance issue.
- The control that changes the outcome is disciplined lifecycle management for vendor accounts, service accounts, and integration credentials.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Third-party accounts and integrations are the main trust path discussed in the article. |
| NHI-01 — Improper Offboarding | The article centres on access that outlives the business relationship that created it. | |
| NHI-05 — Overprivileged NHI | Broad third-party permissions increase the blast radius of a supply chain compromise. | |
| Recommendation — Map supplier access paths to NHI-03 and remove any third-party identity without a named owner. Use NHI-01 to revoke vendor identities and integration credentials when the relationship ends. Apply NHI-05 to shrink third-party access to the minimum scope needed for the task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The attack pattern relies on trusted credentials enabling movement through connected systems. |
| Recommendation — Map third-party credential abuse to TA0006 and TA0008 when tracing supply chain compromise paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing who can still act through delegated access. |
| Recommendation — Apply PR.AA-05 to review and limit third-party entitlements across connected environments. | ||
Key terms
- Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.
- Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Vendor offboarding: Vendor offboarding is the controlled removal of a third party's access, data paths, and operational dependencies when the relationship ends or changes. It is a lifecycle control, not an administrative closeout, because any surviving credentials or integrations remain active security exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org