Vendor email compromise is exposing a major supply-chain blind spot

At a glance

What this is: This is an analysis of vendor email compromise and third-party risk visibility, showing that vendor-driven fraud remains hard to detect because legitimate-looking supply-chain communication blends into normal business traffic.

Why it matters: It matters because IAM, PAM, and governance teams need to understand vendor relationships as an identity and trust problem, not just an email problem, across NHI, autonomous, and human access paths.

By the numbers:

• 44% rate
• Third-party involvement in breaches doubled in 2024, according to Verizon’s 2025 Data Breach Investigations Report.
• Vendor fraud contributed to more than $51B in reported losses between 2013 and 2022.
• Abnormal prevented $349M in vendor fraud losses for customers in 2023 and stopped a single $36M invoice fraud attempt.

👉 Read Abnormal AI's analysis of vendor email compromise and VendorBase

Context

Vendor email compromise is a supply-chain trust problem that exploits normal business communication patterns. When attackers can impersonate or hijack legitimate vendors, traditional detection tuned to malware, phishing volume, or domain reputation misses the real issue: the relationship itself has become the attack surface.

For IAM and governance teams, the lesson is that third-party access, vendor communications, and approval flows need lifecycle visibility. That includes understanding which external identities interact with employees, how those relationships change over time, and where fraud can ride on legitimate trust.

Abnormal AI’s VendorBase frames the issue around continuous vendor discovery and risk scoring, but the broader governance point is independent of any one product. Security teams need to treat vendor identity as a monitored asset, not a static directory entry.

Key questions

Q: How should security teams handle vendor email compromise in enterprise environments?

A: Security teams should treat vendor email compromise as a trust and lifecycle problem, not only a phishing problem. The practical response is to maintain a living inventory of active vendor relationships, tie approvals to behavioural risk signals, and add independent verification for payment or account-change requests that arrive through trusted third-party channels.

Q: Why does vendor fraud remain so effective even when email security is mature?

A: Vendor fraud remains effective because it exploits legitimate business context rather than obvious malicious content. Mature email controls can still miss a convincing request from a real or impersonated supplier, especially when the request matches normal workflows and arrives through an already trusted communication path.

Q: What breaks when organisations rely on static vendor lists for fraud prevention?

A: Static vendor lists break down because they cannot reflect changing contacts, domains, countries, and interaction patterns. That makes it difficult to spot a vendor relationship that has drifted, become compromised, or started behaving outside its normal profile. Fraud defence depends on current behavioural context, not directory completeness alone.

Q: Who is accountable when a fraudulent vendor request leads to payment loss?

A: Accountability should sit with the control owners who govern third-party trust, approval paths, and payment verification, not only with the mailbox team. If vendor requests can trigger money movement without independent confirmation, the governance failure is in business process design as much as in detection.

Technical breakdown

Why vendor email compromise bypasses normal trust controls

Vendor email compromise works because the message is often operationally plausible, not obviously malicious. Attackers imitate known suppliers, payment requests, invoice language, or support workflows, then use compromised vendor accounts or convincing impersonation to blend into existing business context. In identity terms, the fraud succeeds when the receiver assumes the sender relationship is already validated. That assumption breaks because trust is inferred from communication history, not continuously verified through identity signals, behavioral context, and transaction awareness.

Practical implication: tie approval workflows to continuously evaluated vendor identity signals, not to sender familiarity alone.

Continuous vendor discovery and behavioural profiling

Continuous vendor discovery means building a living record of which third parties are actively interacting with users, what domains they use, and how that activity changes. Behavioural profiling adds temporal context, so a sudden shift in contacts, countries, IPs, or internal recipients becomes visible. This is different from a static vendor registry, which quickly becomes stale in large organisations. The technical value is correlation over time: suspicious messages are more meaningful when mapped against a vendor profile that already shows anomalies or unusual interaction patterns.

Practical implication: maintain an always-updated vendor interaction inventory and review changes in vendor behaviour as part of fraud detection.

Federated risk scoring without customer data exposure

Federated intelligence lets a platform reuse threat signals across tenants without centralising customer-specific data. In practice, that means a suspicious vendor pattern detected in one environment can update risk scoring elsewhere without exposing private content or credentials. The useful architectural shift is that third-party risk becomes a shared signal problem rather than a local-only detection problem. For defenders, that matters because vendor fraud often looks low-volume and contextual inside any single tenant, but across many tenants the same sender patterns, domains, or compromise indicators become more obvious.

Practical implication: use federated third-party intelligence to shorten detection time for vendor impersonation and compromise patterns.

Threat narrative

Attacker objective: The attacker wants to monetise trust by diverting payments or extracting sensitive business information through a vendor relationship that users believe is legitimate.

1. Entry occurs when an attacker compromises a vendor account or impersonates a legitimate supplier well enough to enter routine business email flows.
2. Escalation happens when the attacker uses trusted vendor context to request invoice changes, payment redirection, or other high-trust actions from employees.
3. Impact follows when the organisation authorises fraudulent transfers or exposes internal data through a convincing vendor relationship that appears legitimate.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• LiteLLM PyPI package breach — LiteLLM PyPI supply chain attack, credentials stolen from users.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor email compromise is a governance problem, not just a detection problem. The article shows that attackers succeed by exploiting trusted business relationships, which means the core failure is weak lifecycle visibility into third-party identity and communication paths. When organisations do not continuously know which vendors are active, how they interact, and what changed, they cannot govern the trust boundary effectively. Practitioners should treat vendor trust as an identity lifecycle issue, not as a mailbox tuning issue.

Continuous vendor discovery is the right concept, but the real requirement is continuous vendor accountability. A static vendor list cannot support fraud defence because vendor identity is not fixed in practice. Contacts change, domains change, and communication patterns change, so governance has to follow the relationship over time. That places this topic squarely in NHI governance and third-party access lifecycle management, where stale trust creates the opening.

Federated risk intelligence becomes valuable only when it changes decision quality. Shared signals matter because vendor fraud is distributed across many organisations and often too subtle to detect locally. The governance implication is that security teams should expect third-party risk scoring to inform review, escalation, and approval paths, not merely add another alert stream. Practitioners should measure whether vendor intelligence is actually reducing blind spots in business workflows.

Vendor fraud exposes a trust-assumption gap across human IAM and machine identity operations. The same organisation that may tightly govern user access can still leave vendor relationships, payment approvals, and external collaboration flows under-monitored. That gap is especially dangerous where humans act on messages from third parties and where service processes depend on external identities. The implication is that identity governance has to span people, vendors, and automated business workflows as one control surface.

Vendor interaction timelines should be treated as evidence, not metadata. A living chronology of sender identity, recipients, domains, and activity changes creates a defensible investigative record. Without that timeline, analysts are left reconstructing trust after the fact, which is too late for payment fraud and impersonation attempts. Practitioners should use vendor timelines to support escalation decisions and post-incident learning.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
• 46% confirmed and 26% suspected a breach of non-human identities in the same research, showing how often governance gaps remain hidden until impact is visible.
• If you want the broader breach pattern behind this risk, 52 NHI breaches Analysis shows how credential exposure and lifecycle failure repeatedly turn into real incidents.

What this signals

Vendor trust now behaves like an identity control surface. As third-party communications become a fraud path, organisations should expect vendor monitoring to sit alongside IAM, PAM, and lifecycle governance rather than inside email-only operations. The practical shift is to govern who can initiate business-critical requests, not just who can authenticate into systems.

With 72% of organisations already experiencing or suspecting an NHI breach in our research, the deeper lesson is that unmanaged trust states are the norm, not the exception. Vendor relationships are one more place where standing access, stale approval paths, and incomplete lifecycle oversight can compound risk.

If your organisation already tracks machine identities and service accounts, extend the same discipline to external business relationships. The next maturity step is a unified trust model that covers vendors, employees, and automated workflows through the same review and escalation logic.

For practitioners

• Map active vendor relationships continuously Build an always-updated inventory of vendors that actually interact with employees, including contacts, domains, countries, and recurring communication paths. Treat new vendor interactions as a governance event, not a clerical update.
• Bind approvals to vendor behaviour signals Require additional verification when vendor sender patterns, payment language, recipient lists, or IP geography change unexpectedly. Use behavioural context to slow or stop invoice and account-change requests that do not match the established vendor profile.
• Review third-party escalation paths Identify where vendor messages can trigger payment, procurement, or access changes without a second control. Add dual approval or independent callback verification for high-value actions initiated through external communication.
• Use federated intelligence for fraud triage Ingest shared compromise indicators into vendor risk scoring so one tenant’s suspicious pattern can inform another tenant’s controls without exposing customer-specific data. Prioritise alerts that align with high-risk business processes, not inbox volume.
• Preserve vendor interaction timelines Retain message chronology, sender identity, and internal recipient history so investigators can reconstruct how a fraudulent request entered the organisation. Those records also support governance reviews of vendor trust boundaries after an incident.

Key takeaways

• Vendor email compromise succeeds by exploiting trusted business relationships, which makes it a governance issue as much as a detection issue.
• The scale of the problem is substantial, with 44% employee engagement and more than $51B in reported vendor fraud losses over the period cited.
• Continuous vendor discovery, behavioural profiling, and independent verification are the controls that change outcomes in practice.

Key terms

• Vendor email compromise: Vendor email compromise is fraud that uses a trusted third-party communication path to induce an employee to take a harmful action. The attacker may hijack a real vendor account or impersonate one convincingly, then leverage business context to bypass normal suspicion and approval discipline.
• Third-party trust boundary: A third-party trust boundary is the point where an organisation relies on an external party to communicate, authenticate, or initiate business actions. It is not static. In practice, it changes as contacts, domains, workflows, and privileges change, which is why it must be continuously governed.
• Federated intelligence: Federated intelligence is a detection model that shares threat signals across participants without exposing private customer data. For identity and fraud defence, it matters because patterns seen in one tenant can improve risk scoring elsewhere, especially when attacks are low-volume and behaviourally similar.
• Vendor interaction timeline: A vendor interaction timeline is the ordered record of messages, recipients, domains, and notable changes tied to a third-party relationship. It gives analysts context for triage and investigation by showing how a vendor behaved over time, rather than relying on a single suspicious message.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or identity governance in your organisation, it is worth exploring.

This post draws on content published by Abnormal AI: LLMjacking: How Attackers Hijack AI Using Compromised NHIs. Read the original.