Third-party risk is concentrated in patching and credential exposure

At a glance

What this is: Black Kite’s baseline review of roughly 200,000 vendor organisations finds that supply chain risk is being shaped by recurring patch failure and widespread credential exposure, not by isolated breach events.

Why it matters: For IAM, PAM, and NHI practitioners, the point is that third-party posture can appear acceptable while identity leakage and weak remediation keep the attack surface ready for reuse.

By the numbers:

• 53.77% of monitored organisations show patch management failure signals across the ecosystem.
• 23.34% of organisations have corporate credentials circulating on the dark web.

Context

Third-party risk is not only a question of whether a supplier has been breached. It also depends on whether suppliers sit in a baseline condition where vulnerabilities, exposed credentials, and weak remediation make compromise easier to trigger and harder to contain. In that sense, the supply chain is a live control environment, not a static vendor list.

This article is about the steady state that makes downstream incidents possible. Black Kite’s sample shows why high external grades can coexist with real exposure, and why identity leakage across suppliers should be treated as an operating condition rather than an exception. That is a familiar pattern in third-party risk management programmes.

Key questions

Q: What breaks when supplier patching failures and credential exposure persist across the vendor ecosystem?

A: The failure is not a single compromised vendor, but a reusable attack surface that lets the same weakness be exploited across many connected organisations. Once patch gaps and exposed credentials line up across suppliers, attackers need less novelty and more patience. The result is faster compromise, harder containment, and wider downstream spillover through ordinary business dependencies.

Q: Why do high vendor security scores not guarantee lower third-party risk?

A: Because a score measures observable hygiene, not whether current exposures are already present in the environment. A supplier can score well and still have critical vulnerabilities or leaked credentials that matter more than the average. Practitioners should therefore treat scores as a screening signal, then verify live exposure and remediation before granting trust.

Q: How can security teams tell whether a supplier is becoming a concentration risk?

A: Look for the overlap of susceptibility, patch failure, and identity exposure across the same sector or dependency chain. When many suppliers in a path show the same weaknesses, the risk is no longer isolated. It becomes concentrated, reusable, and much more likely to spread if one shared weakness is triggered.

Q: Should organisations trust third-party access when credentials are already circulating on the dark web?

A: No, not without revalidating the supplier’s identity footprint and access scope. Circulating credentials mean the trust boundary has already weakened, even if no breach has been publicly declared. The right response is to constrain or revoke related access, re-check authentication paths, and confirm that the supplier can still control its own identities.

Technical breakdown

Why high cyber grades can mask real supply chain exposure

A cyber grade is a point-in-time measure of observable hygiene, not a guarantee that the organisation is safe under pressure. The article’s core distinction is between external scorekeeping and active exposure signals such as known vulnerabilities, stolen credentials, and operational fragility. That gap matters because a supplier can satisfy checklist-style controls while still presenting a reusable attack surface. In practice, this is why averages are misleading at ecosystem level. Attackers do not exploit the average supplier condition. They exploit the concentration of weak controls inside dependency chains where one exposed partner can create downstream impact across many others.

Practical implication: Use grades as a screening input, then validate suppliers against live exposure signals before trusting them with access or data.

How patch failure turns into systemic third-party risk

Patch failure becomes systemic when the same classes of weakness recur across many interconnected organisations. The article shows that more than half of monitored organisations exhibit patch management failure signals, which means exploitation does not depend on rare zero-days. It depends on repeatable, unaddressed weaknesses that remain available long enough to be reused. This is what turns an isolated technical lapse into ecosystem risk. In a third-party chain, a single vulnerable service can become a common entry path, especially where suppliers expose shared software stacks or internet-facing services. The mechanism is scale, not novelty. See the Software Supply Chain Security Guide.

Practical implication: Track exposed vulnerabilities across suppliers as a shared risk pool, not as separate tickets owned by each vendor.

Why credential leakage is an identity problem, not just a security metric

The article treats stealer log exposure as a supporting signal because it explains how credential-based entry scales. Once corporate credentials are circulating, trust in supplier access becomes conditional rather than assumed. That is directly relevant to IAM because the problem is not merely theft, but persistence of usable identity material outside the organisation’s control. For NHI and human identity programmes alike, the key issue is that exposed credentials can turn a supplier relationship into an access path long before any formal breach is declared. This is the point where identity governance becomes supply chain governance. See the SaaS-to-SaaS and OAuth App Governance Guide.

Threat narrative

Attacker objective: The attacker’s objective is to convert ordinary supplier weakness into scalable access and disruption across multiple organisations.

1. Entry begins when exposed credentials, weak patch discipline, or another recurring control gap gives attackers a repeatable way into supplier environments.
2. Escalation follows when those weaknesses are reused across interconnected organisations, allowing attackers to move from one exposed system or account to another.
3. Impact occurs when compromise propagates through third-party relationships and turns a local failure into broader ecosystem disruption.

Breaches seen in the wild

• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
• Vercel Context.ai OAuth Supply Chain Breach: Shadow AI app Context.ai OAuth integration exposes Vercel customer data via unmanaged third-party token.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Baseline posture is not resilience. A high external grade can coexist with conditions that make breach propagation easy, and that is the central governance problem in third-party ecosystems. The article shows that supply chain risk is concentrated where hygiene metrics and active exposure signals diverge. Practitioners should stop treating vendor scores as a proxy for real trust and instead govern the exposure that sits underneath them.

Patch discipline is now a supply chain control, not a local IT chore. When more than half of monitored organisations show patch management failure signals, the issue is no longer individual remediation speed. It is the existence of a reusable weakness pool across connected vendors. That pool is what threat actors exploit at scale, so third-party governance must evaluate whether suppliers can actually collapse exposure quickly enough to matter.

Credential exposure creates a pre-breach trust gap. Once corporate credentials appear in stealer logs, the supplier relationship has already become partially compromised even if no incident has been declared. That is why SaaS-to-SaaS and OAuth app governance matters here: token and consent governance determine whether leaked access can be converted into lateral access. Identity teams should treat exposed credentials as a governance event, not just an intelligence feed.

Pressure zones matter more than averages. The supply chain does not fail evenly, and the article correctly shows that sectors with elevated susceptibility and weak remediation create disproportionate downstream risk. This is a governance issue as much as a technical one because concentration risk grows where dependency chains rely on organisations already operating near failure. Practitioners should identify those pressure zones and reduce reliance on them before a shared weakness becomes a shared incident.

From our research library:

• Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
• Read next: Third-Party Risk Management Guide

What this signals

Exposure, not reputation, is becoming the better predictor of third-party risk. Supplier scoring still has value, but it cannot substitute for live evidence that vulnerabilities, credentials, and remediation gaps are under control. Programmes that continue to anchor decisions on historical comfort will keep missing the pressure points where attacks actually scale.

Third-party governance is now an identity discipline. The moment supplier credentials circulate externally, the question is no longer only whether the vendor is secure. It is whether access, token scope, and offboarding controls can be trusted under current conditions. That is why third-party reviews need to include identity-bound access paths, not just questionnaires.

For practitioners

• Tighten third-party exposure screening Require suppliers to clear live checks for critical vulnerabilities, credential exposure, and patch failure before they receive or retain access.
• Separate hygiene scores from trust decisions Use cyber grades as a coarse filter only, then base access approvals on current exposure signals and remediation evidence.
• Treat exposed credentials as an offboarding trigger If a supplier’s corporate credentials appear in stealer logs, revoke or constrain related access paths until the identity footprint is revalidated.
• Map supplier dependencies to pressure zones Identify vendors in sectors with high susceptibility and elevated patch failure so you can reduce concentration risk where the ecosystem is weakest.

Key takeaways

• The article shows that supply chain weakness is often structural, with patch failure and exposed credentials combining into repeatable attack conditions.
• The scale is material, with 53.77% of monitored organisations showing patch management failure signals and 23.34% exposing corporate credentials on the dark web.
• Third-party risk programmes need to test live exposure and identity governance, not rely on average scores that can hide active compromise conditions.

Related NHI Mgmt Group resources: Third-Party Risk Management Guide · SaaS-to-SaaS and OAuth App Governance Guide · Software Supply Chain Security Guide · Klue OAuth Supply Chain Breach

Key terms

• Third Party Risk: Third party risk is the chance that an outside organization, supplier, contractor, or service provider will create harm for your business. It includes security, privacy, operational, legal, and compliance exposure caused by access to data, systems, or processes. In identity terms, it often arises from shared credentials, integrations, and delegated trust.
• Ransomware Susceptibility Index: A susceptibility metric that estimates how likely an organisation is to become a ransomware target based on visible exposure and control weakness. Used well, it helps teams prioritise remediation before attackers exploit the gap. Used poorly, it becomes another score with no operational consequence.
• Credential exposure: The condition where a secret, token, key, or certificate becomes visible to a system or user that should not have direct access to it. In AI-assisted workflows, exposure can happen through prompts, files, or agent-accessible directories, which makes containment and runtime gating essential.
• Pressure Zone: A pressure zone is a part of the ecosystem where multiple risk indicators overlap, making failure more likely to propagate. It is not a formal framework term, but it is a useful way to describe where weak patching, identity leakage, and operational strain combine into concentrated risk.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control decisions to broader third-party and cloud access risk.