Risk-based third-party assessments now cut vendor review time

At a glance

What this is: Safe Security describes how one manufacturer rebuilt third-party risk management around tiering, automation, and a single view of exposure, cutting assessment turnaround from months to weeks.

Why it matters: This matters because IAM and governance teams increasingly have to manage supplier access, data exposure, and remediation at a pace that manual questionnaires and email follow-up cannot sustain.

By the numbers:

• The team managed about 90–100 third parties in a single view of exposure scores, findings, and remediation.

Context

Third-party risk management is the control discipline that decides how much access, data exposure, and operational dependency an outside party can have before it becomes a governance problem. In this case, the practical issue was not a lack of scrutiny but a review process so manual that it could not keep up with the vendor footprint.

Manufacturing environments make this problem sharper because suppliers often connect to internal systems and keep operations running. That creates a direct governance bridge between vendor oversight, account access, and the practical limits of manual review. The starting position described here is common, not exceptional.

Key questions

Q: How should organisations tier third-party vendors for risk reviews?

A: Tier vendors by the data they handle, the systems they can reach, and whether operations depend on them. High-risk vendors typically process restricted data or support critical services, medium-risk vendors have limited access or integrations, and low-risk vendors have no meaningful data or system exposure. The point is to route each vendor into the right depth of review before the assessment starts.

Q: What breaks when vendor assessments rely on questionnaires instead of access evidence?

A: They break at the point where paper controls diverge from actual exposure. A vendor can describe strong policies and still hold excessive, standing, or unmonitored access. Security teams should treat access scope, session logs, and revocation state as the real assessment evidence, because those are the controls that determine damage if the vendor is compromised.

Q: How can security teams know whether third-party risk management is working?

A: Look for evidence that inventory, review, monitoring, and revocation are all connected. A working programme produces up-to-date vendor ownership, current access maps, timely reassessments, and documented offboarding. If any of those signals are missing, the programme is probably managing paperwork rather than exposure.

Q: Why do third-party relationships create identity and access risk?

A: Third-party relationships create identity risk because external parties often receive real credentials or delegated access into sensitive systems. If those permissions are broader than needed, poorly monitored, or left active after the work ends, the vendor relationship becomes a persistent attack path. The risk is highest when access is separated from lifecycle governance.

Technical breakdown

Why manual vendor questionnaires stall third-party governance

Long questionnaires create a queueing problem, not just an administrative burden. When every vendor is handled through tickets, email follow-ups, spreadsheets, and ad hoc evidence collection, the assessment becomes serial and slow even when the underlying control questions are familiar. The result is that review depth and review speed start to compete with each other. In practice, teams spend more time moving artefacts than interpreting risk, which means the control objective shifts from informed decision-making to process completion. Practical implication: reduce the logistics layer so analysts can spend their time on exception handling and escalation, not chasing responses. See the Security Questionnaires Guide.

Practical implication: Separate evidence collection from risk judgment so analysts can focus on exceptions and escalation.

How tiering changes the shape of third-party risk decisions

Tiering is a governance mechanism that matches assessment depth to the vendor's data access, system access, and operational dependency. A defensible tier model reduces subjectivity by making the decision path explicit: vendors with restricted data or operational reliance require fuller assessment, while low-risk vendors can move through lighter monitoring. That matters because a single questionnaire structure cannot serve all suppliers equally well. The strongest models turn intake into a classification step, then route the vendor into the right control path automatically. Practical implication: define tier triggers up front so assessment effort is decided by exposure, not habit. See the Third-Party Risk Management Guide.

Practical implication: Define tiering criteria that route vendors into different review paths before the questionnaire starts.

What one view of exposure changes for third-party oversight

A single view of scores, findings, and remediation changes third-party risk from a document workflow into a governance workflow. Instead of assembling status from multiple tools and email threads, teams can see which vendors are active risks, which findings remain open, and where leadership attention is needed. This is especially important when the programme needs to scale without adding headcount at the same rate. The architecture supports better prioritisation, but only if the underlying scoring and remediation logic is consistent. Practical implication: centralise vendor exposure data so escalation and reporting are based on the same record. See the GRC Platform Buyer's Guide.

Practical implication: Centralise exposure, findings, and remediation so escalation decisions use one governed record.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party risk has become an access-governance problem, not just a procurement review. The article shows that vendor oversight now sits directly beside data access, system integration, and operational dependency. That means the control question is no longer whether a questionnaire exists, but whether the organisation can govern outside access at the same speed as business dependency. Practitioners should treat supplier review as part of access governance, not a side process.

Assessment latency is the real control gap. When a vendor review takes one to two months, the organisation is making risk decisions with stale information. The longer the cycle, the more likely the vendor's access, evidence, or exposure profile changes before the review closes. That is a governance failure because the decision lags the condition it is meant to control. Practitioners should design for decision freshness, not just questionnaire completeness.

Vendor tiering is the named concept that matters here: a risk classification model that determines review depth, not a scoring vanity metric. The article's strongest contribution is the shift from a single heavyweight process to a tiered model based on data access and operational dependency. That is the right direction for third-party governance because it aligns effort with exposure and makes automation defensible. Practitioners should use tiering to decide which vendors need full review, which need monitoring, and which need only light-touch oversight.

AI-assisted review is only useful when the underlying control model is already defined. The article's workflow automation works because tiering, scoring, and escalation rules were rebuilt first. Without that structure, AI would simply accelerate inconsistent judgment. This is the broader lesson for governance teams: automate the repeatable parts of vendor oversight, but keep decision logic explicit and reviewable. Practitioners should use automation to speed execution, not to mask weak criteria.

Supplier oversight now intersects with identity governance whenever third parties hold credentials or connect into internal systems. That is where NHI risk enters the picture, because third-party access often depends on accounts, tokens, or integrations that outlive the original review cycle. Third-party risk management only works when those access paths are also governed across issuance, review, and offboarding. Practitioners should treat third-party identities as part of the same risk register as the vendor relationship itself.

From our research library:

• 55% of healthcare data breaches now originate from a third-party vendor, according to Ponemon Institute’s 2023 Third-Party Risk in Healthcare report.
• Read next: Third-Party Risk Management Guide

What this signals

Third-party governance is converging with identity governance. The more suppliers connect into production systems, the harder it is to separate vendor risk from access risk. That is why programmes need a control model that tracks who can connect, what they can reach, and how quickly that access is removed when the relationship changes.

Assessment latency is now a governance signal in its own right. A review cycle that takes weeks or months tells you the control is operating too slowly for the exposure it is meant to manage. Organisations should watch for workflow drag, stale evidence, and manual escalation paths as signs that vendor oversight is falling behind operational reality.

Vendor exposure is now a distributed security problem: 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs. That means third-party oversight has to extend beyond questionnaires into credential scope, integration review, and offboarding discipline.

For practitioners

• Tier vendors by data access and operational dependency Use a plain-language intake model that separates high, medium, and low exposure based on whether the vendor handles restricted data, has internal access, or supports operations. This makes review depth defensible and repeatable.
• Automate follow-ups and reminders before expanding the questionnaire Remove the manual chasing that consumes analyst time by routing reminders, escalations, and status updates through workflow logic rather than email threads.
• Create one governed vendor risk register Keep exposure scores, findings, remediation status, and escalation notes in a single record so leadership decisions reflect the same evidence set. See the GRC Platform Buyer's Guide.
• Review third-party credentials alongside the vendor profile Where suppliers connect to internal systems, make sure account ownership, access scope, and offboarding are reviewed as part of the vendor assessment rather than as a separate afterthought.

Key takeaways

• Third-party risk is failing when review depth depends on manual admin rather than a defensible tiering model.
• The evidence in this case is operational, not theoretical: a process that once took one to two months was reduced to one to two weeks when workflow logic replaced email-driven follow-up.
• The control lesson is clear: align assessment effort to exposure, centralise findings and remediation, and treat third-party access as part of identity governance.

Related NHI Mgmt Group resources: Third-Party Risk Management Guide · Security Questionnaires Guide · GRC Platform Buyer's Guide · Ultimate Guide to NHIs: Key Challenges and Risks

Key terms

• Third-party risk management: Third-party risk management is the process of identifying, assessing, monitoring, and reducing risk introduced by external vendors and service providers. In identity terms, it governs who outside the organisation can reach systems or data, how that access is approved, and when it must be removed.
• Vendor Tiering: Vendor tiering is the practice of grouping third parties by criticality and exposure so review effort matches business impact. A strong tiering model considers data sensitivity, service importance, continuity risk, and integration depth, then uses those factors to decide how often to reassess and what evidence to require.
• Assessment Latency: Assessment latency is the delay between a vendor risk condition existing and the organisation completing review, decision, or remediation. In third-party governance, long latency means the evidence used to approve access may already be stale, which weakens both control effectiveness and escalation quality.
• Vendor Risk Assessment: The broader process of evaluating the likelihood and impact of risk introduced by a supplier, subcontractor, or service provider. A questionnaire is one input to this process, alongside audits, monitoring, contract terms, and offboarding controls that determine whether trust is justified.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect access governance, lifecycle control, and operational risk across identity programmes.