Manufacturing identity governance is failing across partners and suppliers

At a glance

What this is: This is an analysis of manufacturing identity governance across workforce, supplier, dealer, and partner identities, with the central finding that siloed access controls create orphaned accounts, audit gaps, and over-privilege.

Why it matters: It matters because manufacturing IAM teams have to govern external and internal identities across operational systems without losing lifecycle control, segregation of duties, or auditability.

By the numbers:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.

👉 Read OpenIAM's analysis of manufacturing identity governance across workforce and partners

Context

Manufacturing identity governance fails when identity controls stop at employee boundaries and do not follow dealers, suppliers, contractors, and design partners across MES, PLM, ERP, and DMS environments. In practice, the problem is not only access provisioning, but whether joiner-mover-leaver controls, audit trails, and segregation of duties can survive the handoff between corporate identity systems and operational platforms.

The article argues that manufacturing organisations have built identity silos around distinct operational pillars, then tried to govern a shared ecosystem with disconnected processes. That creates orphaned accounts, over-privileged external users, and weak accountability for sensitive design files, plant controls, and supply chain actions.

This is a typical pattern in industrial environments, not an edge case, because external identities are part of daily operations rather than occasional exceptions.

Key questions

Q: How should manufacturers govern dealer, supplier, and contractor access?

A: Manufacturers should govern external identities with the same lifecycle discipline used for employees, but tied to partner events rather than HR events. That means authoritative source alignment, automatic deprovisioning, role-based access, and audit trails across DMS, MES, PLM, and ERP. If access cannot be traced back to a current business relationship, it should not remain active.

Q: Why do orphaned accounts create such a large risk in manufacturing environments?

A: Orphaned accounts are risky because they preserve access after ownership changes, project completion, or supplier rotation. In manufacturing, that access can reach operational systems, design repositories, and production workflows, so persistence becomes a direct security and safety issue. The longer the account survives without review, the larger the attack and compliance exposure.

Q: What do manufacturers get wrong about external identity governance?

A: They often treat external users as exceptions and manage them in local application silos. That leads to inconsistent entitlements, weak segregation of duties, and poor accountability. External identities are not edge cases in manufacturing. They are part of core operations and need one governance model that spans the ecosystem.

Q: Who is accountable when partner access is not revoked on time?

A: Accountability usually sits with the organisation that owns the business relationship and the systems being accessed, not with the former user. Governance teams need clear ownership for lifecycle triggers, approval review, and evidence retention. If the process depends on a person remembering to close access, accountability is already too diffuse to be effective.

Technical breakdown

Orphaned accounts in manufacturing identity governance

Orphaned accounts appear when access remains active after a dealership changes ownership, a contractor finishes work, or a supplier role changes. In manufacturing, that is especially dangerous because the same identity may reach DMS, MES, PLC, or PLM systems with operational consequences. The failure is not just missing deprovisioning. It is the absence of authoritative lifecycle triggers tied to partner change events, so access outlives the business relationship. Once the account persists, the attacker does not need to break in again. They only need to find access that was never closed.

Practical implication: tie external identity deprovisioning to partner and contract lifecycle events, not manual ticket closures.

Why supplier access becomes an access governance problem

Supplier ecosystems create a governance problem because personnel rotate frequently, access is spread across multiple platforms, and privilege changes are often handled in spreadsheets or local application records. That produces inconsistent role assignment and weak auditability. In identity terms, the issue is not simply federation. It is the lack of a single governance layer that can answer who has access, why they have it, and when it should end. Without that layer, suppliers accumulate access that is broader and longer-lived than intended.

Practical implication: centralise supplier identity governance so access scope and end dates are visible across ERP, PLM, and supply chain systems.

External users create contextual access risk on unmanaged devices

Dealers and contractors often authenticate from unmanaged laptops, tablets on the plant floor, or public networks. That makes static username-and-password controls brittle, because the same credential can be reused, stolen, or shared without any contextual signal to stop misuse. The article also shows how generic portal designs encourage shadow IT and shared logins, which erase accountability. In manufacturing, the governance gap is not just identity proofing. It is the mismatch between high-risk operational access and weak contextual controls at login and during high-value actions.

Practical implication: require contextual controls and step-up authentication for high-risk external actions in DMS, MES, and IDM systems.

Threat narrative

Attacker objective: The attacker seeks durable access to manufacturing systems and sensitive operational data that can be used for fraud, sabotage, or intellectual property theft.

1. Entry occurs through compromised dealer, contractor, or supplier credentials that remain valid in externally facing manufacturing portals and operational systems.
2. Escalation follows when shared logins, over-privileged roles, or missing contextual checks let the actor reach MES, PLM, or DMS functions beyond their intended scope.
3. Impact comes from fraudulent orders, altered production settings, exposed design files, or disrupted operational workflows that affect revenue and plant integrity.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• ASP.NET machine keys RCE attack — 3,000+ exposed ASP.NET machine keys enabled remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manufacturing identity governance fails when lifecycle control stops at the corporate perimeter. The article shows that employees may be governed in SAP or Active Directory, while dealers, contractors, and suppliers are left to local portals and spreadsheets. That separation breaks joiner-mover-leaver discipline because access outlives the relationship that justified it. The practical conclusion is simple: any programme that cannot govern external identities as part of the same lifecycle model is structurally incomplete.

Orphaned account persistence is the clearest failure mode in this ecosystem. A dealership changes ownership, a contractor leaves the plant floor, or a supplier rotates personnel, yet access to DMS, MES, or PLM remains active. That is a governance failure, not just an admin delay. Vendor access without lifecycle offboarding: the account remains useful after the business reason for access has expired. Practitioners should treat that as the core control gap the article exposes.

Manufacturing identity governance needs a single audit story, not separate application logs. The article repeatedly shows that auditors cannot reconcile who approved access, who used it, and whether SoD was preserved across systems. When identity evidence is fragmented across MES, PLM, DMS, and supplier portals, accountability becomes a reconstruction exercise instead of a control outcome. The field should read this as a warning that access governance without end-to-end evidence is only partial governance.

Contextual access controls matter more in industrial partner ecosystems than in standard employee IAM. External identities often log in from unmanaged devices and high-variance locations, then perform high-value actions like order placement, design access, or production changes. That means static authentication and flat portal design are insufficient for the risk profile. Practitioners should re-evaluate where step-up, device signals, and role-specific journeys are mandatory rather than optional.

Identity blast radius is the right concept for manufacturing ecosystems. A single shared login or over-privileged partner account can reach financial workflows, operational data, and production controls in one environment. That changes the governance question from who should have access to how far that access can travel when the identity is external. Teams should map blast radius by identity class, not by application alone.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, which is why unmanaged external access deserves board-level attention.
• Read Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs for the operational model that closes the offboarding and review gaps this article exposes.

What this signals

Orphaned identity persistence: the article shows that manufacturing programmes can no longer treat external identities as temporary exceptions. Once dealers, suppliers, and contractors are part of production and design workflows, the governance model has to track lifecycle end events with the same discipline as joiner and mover events. Teams that still split employee and partner governance into separate processes will keep creating uncontrolled access residue.

Manufacturing IAM leaders should expect stronger scrutiny of evidence quality, not just access provisioning. If audit trails cannot link who approved an entitlement, which system used it, and whether the access was still justified after a partner change, the programme will be judged incomplete. The most practical near-term signal is whether external identity evidence can be produced in one place rather than reconstructed from multiple applications.

A useful reference point is the organisational maturity gap we see in broader NHI governance: 88.5% of organisations say their non-human IAM practices lag behind or only match human IAM. That same pattern shows up here in manufacturing when partner identities are managed as edge cases instead of first-class identities, so the next step is to unify lifecycle, privilege, and evidence across the ecosystem.

For practitioners

• Map every external identity source Build an inventory of dealer, contractor, supplier, and partner identity sources, then reconcile them to DMS, MES, PLM, and ERP access paths. Do not rely on spreadsheets as a control boundary.
• Bind offboarding to partner lifecycle events Trigger deprovisioning when contracts end, supplier personnel change, or dealership ownership changes. Manual closure steps are too slow for manufacturing environments where access can outlive the business relationship.
• Separate high-risk actions from routine access Use step-up authentication for orders, design exports, production changes, and other high-value actions. Keep ordinary portal access simpler, but add stronger control where the operational impact rises.
• Eliminate shared external logins Replace generic dealer and maintenance accounts with named identities and auditable approvals. Shared access destroys attribution and makes forensic review almost impossible after fraud or misuse.
• Centralise audit evidence across systems Create a unified evidence trail that links approval, entitlement, and activity data across MES, PLM, DMS, and supplier portals. Auditors should not need separate system-by-system reconstructions to answer one access question.

Key takeaways

• Manufacturing identity governance breaks down when external identities are managed outside the same lifecycle model as employees.
• Orphaned partner accounts, shared logins, and fragmented audit trails create both operational and compliance exposure.
• Manufacturers need unified lifecycle triggers, contextual access controls, and end-to-end evidence to reduce identity blast radius.

Key terms

• Orphaned Account: An account that remains active after the person, contractor, supplier, or partner who should own it has left or changed role. In manufacturing, orphaned accounts can still reach operational systems, so they represent an access control failure, not just an administrative oversight.
• Segregation of Duties: A governance control that prevents one identity from holding conflicting permissions that could enable fraud, unsafe change, or unauthorised approval. In manufacturing, SoD must cover external users as well as employees when partner accounts can affect production, quality, or financial workflows.
• Identity Blast Radius: The range of systems, data, and operational processes an identity can affect if it is compromised or misused. In manufacturing, blast radius is often wider than expected because one dealer or supplier account may touch finance, design, and production services.
• Joiner-Mover-Leaver: An identity lifecycle process that grants, changes, and removes access as a person or organisation enters, changes, or exits a business relationship. In manufacturing, JML must extend to suppliers, dealers, and contractors, not just employees, or access will persist after the relationship ends.

What's in the full article

OpenIAM's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step manufacturing workflow mapping across DMS, MES, PLM, ERP, and dealer portals.
• Detailed implementation examples for automated joiner-mover-leaver processes in supplier and contractor environments.
• Named control patterns for RBAC, SoD, and contextual authentication in partner-facing workflows.
• Specific portal and lifecycle scenarios for dealer onboarding, consent, and high-volume access periods.

👉 OpenIAM's full article adds the operational detail on lifecycle automation, SoD controls, and dealer access workflows.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.