TL;DR: Third-party compromise remains a practical route into enterprise environments, and Saviynt cites the Sisense breach as evidence that supplier access can cascade into identity and data risk. Governance has to extend beyond direct systems of record to the external services and credentials that can reach them.
At a glance
What this is: This analysis argues that supply chain attacks expose a governance gap in identity control, because third-party access can outlive the trust and oversight assumptions behind it.
Why it matters: IAM, PAM, NHI, and third-party governance teams need to treat external access as a managed identity surface, not just a procurement or vendor-risk issue.
Context
Supply chain attacks are a governance problem as much as a technical one. When a trusted supplier, integration partner, or platform gains reach into systems of record, the identity boundary expands beyond the enterprise perimeter and the usual control assumptions weaken.
That matters because third-party access often arrives through non-human identities, delegated credentials, or service integrations that are not governed with the same lifecycle discipline as internal users. Saviynt uses the Sisense breach to show how compromise in one organisation can become exposure in another.
Key questions
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes. That creates hidden privilege accumulation, weak ownership, and poor revocation discipline. The result is broader attack surface and slower response when access needs to be removed.
Q: Why do supply chain attacks so often turn into identity incidents?
A: Because attackers are not only changing code, they are harvesting the non-human identities that code runs beside. API keys, cloud credentials, SSH keys, and registry tokens give direct access to infrastructure and publishing systems, so a compromised package becomes an identity compromise with wider blast radius.
Q: What are the warning signs that non-employee identity governance is failing?
A: Common signs include not knowing how many non-employee identities exist, finding duplicate or shared accounts, and seeing access that no longer matches sponsor ownership. When those signals appear, the governance model is already drifting away from the actual identity estate. A healthy programme can reconcile identities, sponsors, and entitlements at the same time.
Q: Should organisations treat supplier access as part of PAM or separate from it?
A: Supplier access should be governed as part of PAM when it can reach high-value systems or sensitive data. External accounts often need tighter scoping, stronger monitoring, and faster revocation than ordinary user access. If a third party can perform privileged actions, the controls protecting that access should be aligned with privileged access management, not left in a separate vendor file.
Technical breakdown
Third-party access becomes an identity boundary problem
Supply chain compromise is not only about software tampering or malicious updates. It is about trusted external access paths that already exist, such as integrations, API credentials, support channels, and shared admin relationships. Once those paths are in place, the enterprise is no longer controlling just its own accounts; it is also inheriting the supplier’s identity hygiene, offboarding discipline, and privilege scope. That is why vendor risk and identity risk converge. A third party with excessive reach can turn routine business connectivity into an attack surface that looks legitimate until abuse begins.
Practical implication: Map every supplier connection to the specific identity, secret, or token that enables it, then govern that access as part of the identity programme.
Why non-human identities amplify supply chain exposure
Non-human identities are especially important in supply chain scenarios because they are often the actual mechanism of trust between companies. API keys, tokens, certificates, automation accounts, and delegated service credentials can persist long after the business rationale changes. If those credentials are shared, overprivileged, or insufficiently monitored, compromise can spread laterally through systems that still regard the external party as trusted. This is why third-party NHI governance needs inventory, ownership, scoping, and revocation discipline, not just periodic assurance questionnaires.
Practical implication: Inventory third-party NHIs separately from human access and apply lifecycle controls to each credential or service account.
Identity controls need blast-radius thinking
Traditional identity controls often focus on authentication at the point of access, but supply chain attacks expose the weakness of that view. The real issue is blast radius: how far an external identity can move once it is admitted. If access is broad, persistent, or poorly segmented, a compromise at one supplier can become data theft, token theft, or downstream account abuse inside the customer environment. That makes least privilege necessary but not sufficient. Practitioners also need segmentation, conditional access, and continuous review of external trust paths.
Practical implication: Reduce the reach of every external identity so a supplier compromise cannot become a full-environment incident.
Threat narrative
Attacker objective: The attacker objective is to turn a trusted supplier relationship into a reusable path into customer identities, systems, and data.
- Entry occurs through a trusted supplier or integration path rather than a direct attack on the customer environment.
- Attackers abuse or steal the external credentials, tokens, or delegated access that connect the supplier to downstream systems.
- The compromised access enables movement into customer systems, data access, or additional credential exposure.
- Impact is driven by the trust relationship itself, because one compromised third party can create multi-tenant or downstream exposure.
Breaches seen in the wild
- reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
- Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Supply chain attacks are identity attacks once the supplier holds the keys: The control problem is no longer confined to the victim organisation’s perimeter. When a third party can authenticate into downstream systems, the customer inherits that party’s access design, revocation discipline, and privilege scope. Practitioners should treat supplier access as a governed identity domain, not a contractual footnote.
Third-party NHI governance is the missing layer in many programmes: Most organisations can name their vendors but cannot fully enumerate the machine identities those vendors use to reach them. That leaves API keys, automation tokens, and service credentials outside the same ownership and review discipline applied to employee accounts. The implication is clear: external access needs the same lifecycle governance as internal privileged access.
Blast radius, not just authentication, determines breach impact: A trusted connection can still be unsafe if its permissions are broad, persistent, or shared across environments. Supply chain incidents show that the decisive question is not whether the supplier is authenticated, but how far that identity can travel once admitted. Security teams need to evaluate external access by downstream reach, not by login success alone.
Vendor trust is now an identity control decision: Supplier assurance, access provisioning, and credential governance are converging into one discipline. That convergence matters because the identity boundary now includes partners, service providers, and automated integrations that can act at machine speed. The practitioner conclusion is to align third-party governance with IAM, PAM, and NHI oversight instead of treating them as separate programmes.
Named concept: identity blast radius: This article illustrates how the practical risk is not just exposure, but how far a compromised external identity can propagate into connected systems. Once blast radius expands through supplier relationships, the enterprise needs to govern reach, segmentation, and revocation together. Teams should assess every external identity by the damage it can do before the relationship is trusted.
From our research library:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity blast radius: Supply chain incidents are exposing the difference between a trusted connection and a governed one. The security question is no longer whether a vendor is authenticated, but how far its credentials can move once admitted into your environment.
Third-party access should now be measured as a lifecycle problem. If supplier-issued secrets, tokens, or certificates are not owned, segmented, and revoked with the same rigor as internal access, the organisation is carrying hidden trust debt across every integration.
External identities deserve the same operational discipline as employee access reviews, because partner relationships change faster than many review cycles. When offboarding lags behind commercial reality, compromise can persist well after the contract does.
For practitioners
- Map every third-party identity path Create an inventory of supplier accounts, service credentials, API keys, certificates, and delegated tokens that can reach your environments. Tie each one to an owner, purpose, and expiry condition.
- Separate human and non-human third-party access Review external access with different criteria for people and machine identities, because service credentials often survive longer and reach deeper than contractor logins.
- Apply blast-radius limits to external integrations Restrict every vendor path to the minimum systems and data it needs, and segment high-value assets away from shared supplier access.
- Build offboarding into supplier governance Make revocation of external credentials a formal exit step for every vendor relationship change, contract end, or integration retirement.
Key takeaways
- Supply chain compromise becomes an identity problem when vendors and integrators hold credentials that can reach core systems.
- The article’s figures point to a broad exposure pattern, with 92% of organisations exposing NHIs to third parties and 59% of compromised machines in one major attack being CI/CD runners.
- The practical control gap is lifecycle governance, because external access must be inventoried, limited, and revoked before trust turns into breach exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Third-party supplier access is the central exposure pattern in this article. |
| NHI-05 — Overprivileged NHI | The article focuses on supplier access that can move too far once admitted. | |
| NHI-07 — Long-Lived Secrets | Supply chain exposure often persists because external secrets outlive the relationship. | |
| Recommendation — Inventory and govern every third-party NHI that can reach your environments. Reduce external credential scope to the minimum systems and data required. Rotate and revoke supplier secrets as part of offboarding and contract change. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about governing who can reach what through trusted access paths. |
| Recommendation — Apply entitlement reviews to third-party access paths before they expand blast radius. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The threat pattern involves stolen or abused credentials moving through trusted supplier paths. |
| Recommendation — Map supplier credential abuse to credential access and lateral movement detections. | ||
Key terms
- Third-Party NHI: Third-Party NHI is a non-human identity owned or operated by an external organization, partner, contractor, or supplier. It includes service accounts, API keys, certificates, tokens, and automated agents that access systems outside the primary enterprise boundary. Governance must cover issuance, scope, monitoring, revocation, and contractual accountability.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Delegated trust: Delegated trust is the decision to let another system or organization issue, validate, or transmit access on your behalf. It is common in cloud and SaaS environments, but it becomes risky when scope, duration, and revocation are not tightly controlled. In NHI governance, delegated trust must be explicit and continuously reviewable.
- Vendor offboarding: Vendor offboarding is the controlled removal of a third party's access, data paths, and operational dependencies when the relationship ends or changes. It is a lifecycle control, not an administrative closeout, because any surviving credentials or integrations remain active security exposure.
Deepen your knowledge
NHI governance, machine identity security, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org