Singapore’s top companies face universal third-party breach exposure

At a glance

What this is: SecurityScorecard reports that all of Singapore’s top 100 companies were hit by at least one third-party cyber breach in the past year, even though direct breaches were far less common.

Why it matters: This matters because third-party exposure now shapes assurance, vendor governance, and identity-bound access decisions across both enterprise and NHI programmes.

By the numbers:

• 100% of Singapore’s top 100 companies experienced at least one third-party breach in the past year.
• Only 5% of Singapore’s top 100 companies suffered a direct breach, primarily caused by malware infections.
• Companies with an “A” cybersecurity rating saw 93% no known breach rates.
• Only 4% of Singaporean firms were rated “C” or lower, compared with a 31% average across Europe.

Context

Third-party breach exposure is a supply chain governance problem, not just a vendor-risk scorecard issue. When breaches land through external partners, internal security ratings can look healthy while attack paths still enter through delegated trust, shared data access, and unmanaged integrations.

This is relevant to IAM and NHI practitioners because third-party access is usually implemented through service accounts, tokens, API keys, and federation links that outlive the business context that created them. In other words, the control gap is often in identity-bound access to suppliers, not only in perimeter security.

The Singapore pattern is not an outlier in principle, even if the concentration of top-tier firms makes the finding stark. Organisations that assume strong internal ratings are enough are likely underestimating fourth-party exposure and overestimating how much direct control they have over external trust chains.

Key questions

Q: What breaks when non-human access is left outside IAM controls?

A: Healthcare teams lose visibility into who or what changed data, touched records, or moved through administrative workflows. That creates blind spots in compliance, patient safety, and incident response because the organisation cannot prove whether the access was expected, excessive, or still needed.

Q: Why do strong internal security ratings not prevent supplier-driven breaches?

A: Because internal ratings measure your own posture, not the trust chains created by vendors and their dependencies. A company can harden endpoints, patch systems, and still remain exposed if third-party identities can reach data or services through delegated access. The risk sits in inherited trust, not just in the organisation’s own controls.

Q: What are the signs that third-party identity access is too broad?

A: Warning signs include suppliers that can read more user metadata than they need, support accounts with persistent access, and recovery workflows that bypass normal governance. If a partner can retrieve logs, view contact details, or influence trust decisions without tight approval controls, the access model is broader than the business need.

Q: Who should be accountable for third-party cyber risk under a shared-responsibility model?

A: Accountability should sit with the business owner of the relationship, supported by security, IAM, and procurement. Security defines the control baseline, but the business function that depends on the supplier must own the risk decision, the access approval, and the offboarding outcome. Without that split, external access tends to persist by default.

Technical breakdown

Why third-party breaches bypass internal security ratings

A third-party breach is an incident that enters through a supplier, partner, or connected platform rather than through the victim organisation’s own perimeter. Internal security ratings usually measure the enterprise’s own posture, but they do not fully capture the trust paths created by external SaaS, integrations, outsourced operations, or downstream suppliers. That is why a company can score well internally and still be exposed through another organisation’s credentials, sessions, or data-sharing links. The real weakness is often delegated trust without equivalent governance, not a lack of internal hardening.

Practical implication: extend assurance reviews beyond direct vendors to the identity and access paths they create into your environment.

How fourth-party risk expands the attack surface

Fourth-party risk is the exposure introduced by a vendor’s own suppliers, sub-processors, or connected service providers. It matters because many business services depend on chains of trust that are invisible to the buying organisation, especially where tokens, OAuth grants, federated access, or shared administrative access are involved. The deeper the chain, the harder it becomes to prove who can reach what, under what conditions, and with which credentials. This is why supplier oversight must move from point-in-time questionnaires to lifecycle control of external access and data paths.

Practical implication: map fourth-party dependencies for critical suppliers and treat their access paths as part of your control boundary.

Why identity governance is central to third-party resilience

Third-party resilience is not just about malware, patching, or perimeter controls. It also depends on how external identities are issued, scoped, reviewed, and revoked across business partners, contractors, and automated integrations. Where third parties rely on service accounts, API keys, or federated identities, a weak lifecycle can turn a contained supplier issue into enterprise exposure. That is why IAM and NHI governance sit inside supply chain security, not alongside it. If access is persistent, overbroad, or poorly inventoried, supplier trust becomes an attack path.

Practical implication: apply identity lifecycle controls to third-party accounts and machine credentials with the same rigour as internal privileged access.

Threat narrative

Attacker objective: The attacker’s objective is to exploit trusted external relationships to reach enterprise data or services that would be harder to access directly.

1. Entry occurs through third-party or fourth-party access paths rather than through the organisation’s own security boundary.
2. Credential or trust abuse then lets the attacker reach data, services, or systems that were exposed through delegated access.
3. Impact follows when the external relationship broadens blast radius beyond the supplier into the customer environment.

Breaches seen in the wild

• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.
• Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party exposure is now a core identity governance problem, not a procurement problem. When organisations connect suppliers through federated access, API keys, service accounts, and shared data workflows, they are extending their identity perimeter beyond their direct control. The finding that every top Singapore company saw third-party breach exposure shows that internal ratings alone do not define resilience. Practitioners should treat supplier access as governed identity infrastructure, not as static vendor due diligence.

Fourth-party risk is the hidden amplifier in modern supply chains. A supplier may be vetted, yet its own dependencies can still become the path of compromise. That makes questionnaires and annual attestations too shallow for the operational reality of external trust chains. Security teams need visibility into who their vendors depend on, because trust inheritance is where exposure often multiplies.

Delegated trust gap: this article highlights the gap between knowing a supplier is approved and knowing whether its access is still safe, scoped, and reversible. The governance failure is not simply weak vendor management; it is the absence of continuous control over external identity lifecycles. The practitioner conclusion is clear: external access must be managed as a living control, not a one-time approval.

Strong internal ratings can coexist with weak supplier resilience. The report’s contrast between high A-rated resilience and widespread third-party exposure shows that posture scoring and supply chain assurance solve different problems. A company can harden itself and still remain reachable through an external relationship that was never brought under the same control discipline. The implication for the market is that identity governance and supplier assurance are converging, and teams must plan for both.

Machine identities are part of the third-party problem. In many organisations, the most persistent external trust paths are not human users but tokens, integrations, and workload credentials that sit outside traditional access review processes. That makes NHI governance relevant to supplier resilience, because a third party’s breach often becomes a customer’s identity problem through standing machine access. Practitioners should inventory external non-human identities as part of third-party assurance.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Supplier trust now needs identity-grade governance. The organisations most likely to be resilient are the ones that can inventory every external access path, bind it to an owner, and revoke it cleanly when the relationship changes. That is the practical difference between vendor oversight and access control.

External identities should be treated as part of the control boundary. Service accounts, delegated tokens, and federated accounts can all become persistence points when a supplier is compromised. Practitioners who do not model those identities in their assurance programme will keep discovering risk only after an incident.

The Singapore findings also reinforce a wider market shift: supply chain assurance is becoming inseparable from IAM and NHI governance. Teams that can prove they control third-party identity lifecycles will be better placed to reduce blast radius, even when supplier ecosystems remain complex.

For practitioners

• Map external identity paths Inventory every third-party and fourth-party access path into critical systems, including federated logins, service accounts, tokens, and API keys.
• Review supplier offboarding controls Test whether terminated suppliers still retain valid credentials, active integrations, or data access routes in production and non-production environments.
• Tie access reviews to business owners Assign explicit internal ownership for each external account, integration, and data-sharing relationship so that reviews have a clear accountable approver.
• Track machine credentials in vendor relationships Include service accounts, delegated tokens, and other non-human identities in third-party risk reviews, not only human accounts and contracts.

Key takeaways

• Third-party exposure can dominate enterprise breach risk even when internal security posture appears strong.
• The gap is not only vendor vetting but continuous control over external identities, tokens, and downstream dependencies.
• Supplier resilience improves when access ownership, scope, and offboarding are treated as living controls rather than annual checks.

Key terms

• Third-party breach exposure: Third-party breach exposure is the risk that an organization is harmed because a supplier, contractor, partner, or other external party is compromised. It includes stolen data, unauthorized access, malware spread, and operational disruption. The exposure arises when external access, shared data, integrations, or trust relationships extend the attack surface beyond direct control.
• Fourth-party risk: Fourth-party risk is the exposure created by a vendor’s own vendors, sub-processors, and downstream service dependencies. It matters because direct contractual control usually stops at the first tier, while operational and data-risk propagation often continues much further through the chain.
• Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.
• External identity lifecycle: External identity lifecycle is the end-to-end management of onboarding, changes, access reviews, and offboarding for non-employee users or organisations. It matters because stale accounts, weak revocation, and unclear provenance are common failure points when identity spans multiple domains.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management for practitioners who need to control access beyond the human user boundary. It helps security teams connect identity governance to supplier access, machine credentials, and operational risk.