Third-party breach concentration outpaced disclosure in 2025

At a glance

What this is: Black Kite’s 2026 third-party breach report shows that breach concentration and disclosure lag, not isolated incidents, drove most downstream impact in 2025.

Why it matters: IAM, NHI, and third-party access programmes matter here because exposed vendor access, credentials, and delegated trust can turn one breach into many downstream compromises.

By the numbers:

• 2025 saw 136 verified third-party breach events, with 5.28 downstream victims per vendor.
• Black Kite reported 719 publicly named victim companies and about 26,000 additional impacted companies that were never named.
• The median disclosure delay was 73 days, even though detection took 10 days in the events with timeline data.
• Across the monitored ecosystem, 53.77% had at least one critical vulnerability detected and 23.34% had corporate credentials circulating on the dark web.

Context

Third-party breach risk is no longer best understood as a vendor-by-vendor hygiene problem. It is a concentration problem, where a small number of highly connected suppliers can create a broad downstream impact when controls, disclosure, and customer visibility do not move at the same pace.

In identity terms, this is the same structural issue that appears when outsourced access, shared credentials, and delegated administration are treated as one-off exceptions instead of governed relationships. Third-party access and offboarding controls matter because the blast radius often extends far beyond the original victim.

The pattern in this report is not unusual for modern ecosystems. What is unusual is the scale at which the same weaknesses keep repeating across vendors, industries, and downstream customers.

Key questions

Q: What breaks when a vendor with deep integration access is compromised?

A: The break is usually in the institution’s identity governance, not just the vendor’s security. If you cannot see what credentials the vendor holds, what systems they can reach, and how quickly those privileges can be revoked, the incident becomes a client-side containment problem. Vendor compromise then creates uncertainty, delayed revocation, and broader operational impact.

Q: Why does delayed disclosure make third-party breaches harder to contain?

A: Because containment depends on timely revocation, and delayed notice leaves attacker access active while customers still assume the vendor is safe. If disclosure arrives weeks after detection, service accounts, tokens, and partner access may remain usable long enough to spread impact. The governance gap is not only visibility, but response timing.

Q: How should security teams prioritise third-party risk reviews?

A: Prioritise vendors by both exposure and connectivity. A supplier with average posture but deep integration into identity, data, or operational workflows can create more systemic risk than a weaker but isolated provider. Review the vendors whose compromise would affect the most internal systems, credentials, or customer records first.

Q: What signals show a vendor relationship is becoming a concentration risk?

A: Look for a vendor that is deeply embedded, hard to replace, and granted broad access to multiple environments or critical workflows. If one supplier can affect many systems, the relationship has become a concentration risk even if its headline cyber score looks acceptable.

Technical breakdown

Why concentration risk turns one breach into many victims

Third-party ecosystems create dependency chains, and those chains concentrate operational trust. When a vendor sits inside multiple customer environments, a compromise can propagate through support access, federated identities, software integrations, or data-sharing paths. The core issue is not simply that a vendor was breached, but that the vendor held enough privileged connectivity for the incident to become systemic. In identity terms, this is delegated trust without a sufficiently narrow scope, lifecycle, or containment boundary. The more central the vendor, the more likely a single failure becomes a cross-customer event. See the Third-Party Risk Management Guide.

Practical implication: Map every high-trust vendor relationship to the access paths, credentials, and data flows it can touch, then reduce the blast radius before the next incident.

Why disclosure lag is now a security control problem

Detection and disclosure are not the same control. A vendor may identify an intrusion quickly, but if customers are informed weeks later, downstream defenders cannot rotate credentials, revoke federation, or harden exposed integrations in time. This creates a silent window in which compromise remains active while the ecosystem continues to trust the affected party. For IAM and NHI teams, delayed disclosure is especially costly because service accounts, API keys, OAuth grants, and partner access often remain valid long after the underlying incident is known internally. Read Top 10 NHI Issues.

Practical implication: Build disclosure assumptions into access governance so vendor-connected credentials and tokens can be contained even when the external notification arrives late.

How baseline weaknesses become a downstream breach multiplier

The report’s posture data shows that concentration risk is amplified by ordinary control failure: critical vulnerabilities, exposed credentials, and weak patch discipline. These are not exotic attack conditions. They are the enabling environment that lets attackers move from one compromised supplier to many affected customers. Where visibility is weak, customers often do not know which vendor relationships are most exposed, which makes prioritisation reactive instead of risk-led. Identity governance has to cover third-party access as a continuous control domain, not a procurement artifact. Read the Ultimate Guide to NHIs: Key Challenges and Risks.

Practical implication: Use third-party risk scoring to prioritise access review, credential rotation, and containment for vendors with both exposure and connectivity.

Threat narrative

Attacker objective: The attacker’s objective is to turn one compromised supplier into repeated downstream access, data theft, or operational disruption across many customers.

1. Entry begins when threat actors compromise a third party that already holds trusted access or data paths into customer environments.
2. Escalation occurs when the vendor’s connectivity, credentials, or integrations let the attacker reach multiple downstream organisations from one foothold.
3. Impact expands as disclosure trails detection by 73 days at the median, leaving customers exposed while the vendor relationship remains trusted.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Third-party breach concentration is now an identity governance problem, not just a vendor risk problem. When a supplier can reach many customers, the control question becomes who or what can still authenticate, delegate, or remain trusted after that supplier is compromised. That shifts the centre of gravity from vendor questionnaires to access scope, token lifecycle, and offboarding discipline. Practitioners should treat third-party access as an identity control surface, not a procurement checkbox.

Disclosure lag creates a governance vacuum that IAM teams must plan for. A 73-day median delay means the external ecosystem often learns about compromise long after internal detection. That makes partner access, federated trust, and shared credentials uniquely dangerous because revocation may come too late unless customers already have containment playbooks. Security teams should assume notification will lag and design for independent containment.

Shadow impact is the right concept for third-party incidents that never become public. The report’s unnamed victim layer shows that breach impact is frequently larger than the official disclosure set. This matters for identity programmes because the true exposure set can include dormant partner accounts, stale OAuth grants, and inherited access paths that were never fully inventoried. Third-party access governance has to account for the unseen perimeter.

Concentration risk exposes the limits of A-grade reporting. A strong average cyber grade can mask the fact that a few central suppliers carry outsized connectivity and therefore outsized systemic risk. That means executive reporting should distinguish posture from dependency density. Practitioners should measure not only how secure a vendor looks, but how many active trust relationships hinge on it.

Cascading failure is the named concept this report makes unavoidable. The article shows that the weakest link is not always where the breach begins; it is often where trust is most concentrated and least replaceable. That is a governance failure mode, not a one-off incident pattern. Security leaders should redesign third-party controls around containment, not optimism.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party Risk Management Guide

What this signals

Concentration risk changes the unit of analysis for third-party governance. Teams should stop asking only whether a supplier is secure enough and start asking how much downstream trust that supplier carries. When a breach can cascade faster than disclosure, the control objective becomes containment of the dependency graph, not confidence in a single score.

Third-party access governance now has to assume the silent window. If detection arrives in days and disclosure in weeks, then partner tokens, federated sessions, and service accounts need response paths that do not depend on waiting for the vendor’s public notice. The programme implication is clear: build independent revocation authority for the relationships that matter most.

Shadow exposure is the more accurate risk metric for supplier ecosystems. The report’s unnamed victim layer shows that official breach counts understate real impact. For identity programmes, that means the effective exposure set includes every external relationship that can still authenticate or move data after a vendor compromise, even when the public record never names it.

For practitioners

• Inventory third-party trust paths Document every vendor connection that can authenticate, transfer data, or execute actions in your environment, including federated access and API-based integrations.
• Set containment triggers for vendor compromise Predefine when to revoke partner tokens, disable shared accounts, and isolate integrations if a supplier is disclosed or shows compromise indicators.
• Prioritise high-connectivity suppliers first Rank vendors by business criticality and downstream reach, then review the ones whose access can affect the most internal systems or records.
• Build delayed-disclosure assumptions into playbooks Assume a vendor may know about an incident long before customers are told, and prepare independent monitoring for the access they control.

Key takeaways

• Third-party breach risk is increasingly driven by concentration, where one compromised supplier can affect many downstream organisations.
• The report’s numbers show both scale and invisibility, with 136 verified events, 719 named victims, and about 26,000 additional impacted companies that were never publicly named.
• Containment has to start before disclosure, because delegated trust, federated access, and shared credentials can keep an incident active long after detection.

Related NHI Mgmt Group resources: Third-Party Risk Management Guide · Third-Party, B2B and Contractor Access Guide · Ultimate Guide to NHIs: Key Challenges and Risks · BeyondTrust breach 2024

Key terms

• Third-Party Breach Concentration: A risk pattern in which a small number of suppliers create disproportionate downstream exposure because many organisations depend on them at once. The concern is not only vendor weakness, but the number of trust relationships, integrations, and credentials that can be affected by one compromise.
• Disclosure Lag: Disclosure lag is the delay between a vulnerability becoming public and that vulnerability appearing in the systems defenders use for prioritisation and reporting. In practice, the lag creates a blind spot where risk is real but not yet fully reflected in formal control processes.
• Silent Window: The period after a breach is known internally but before customers can act on it. This window matters most when the compromised party controls federated access, API credentials, or shared operational workflows, because trust continues even though the underlying assurance has already failed.
• Shadow Layer: The population of affected organisations that are not publicly named after a third-party incident. It reveals that official victim counts often understate the true blast radius and that practitioners must plan for more exposure than the disclosure record shows.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management for practitioners responsible for third-party trust. It helps security teams connect identity controls to the wider risk surface created by vendors, partners, and integrated services.