Vendor email compromise is exposing a major supply-chain blind spot

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Abnormal AI's blog post: Vendor email compromise and third-party risk remain major blind spots when trusted business communications are not continuously discovered and scored.

Why it matters: IAM and security teams need better visibility into vendor-to-employee interactions because supply-chain abuse now sits inside routine communication flows, where traditional controls often miss fraud, impersonation, and trust abuse.

By the numbers:

• Employees engage with vendor email compromise attacks at a 44% rate, making them hard to detect and avoid.
• Third-party involvement in breaches doubled in 2024, according to Verizon’s 2025 DBIR cited by Abnormal AI.
• Vendor fraud drove over $51B in reported losses between 2013 and 2022.
• Abnormal prevented $349M in vendor fraud losses for customers in 2023.

Context

Vendor email compromise is a supply chain trust problem, not just an email filtering problem. When attackers impersonate or compromise legitimate vendors, they exploit the fact that routine business communication already carries implicit authority across procurement, finance, and operations.

The identity security issue is visibility into third-party relationships, not merely message inspection. If a programme cannot reliably map which vendors are talking to which employees, it cannot govern the trust boundary that those communications create.

The article’s core claim is that organisations need continuous vendor discovery and risk scoring because vendor relationships change over time and are used as an entry point for fraud. That is a typical blind spot in environments where IAM and business process ownership are fragmented.

Key questions

Q: What breaks when organisations cannot see which vendors are actively communicating with employees?

A: The trust boundary breaks first. Without a live view of vendor-to-employee communication, security teams cannot tell whether a message is routine, newly introduced, or suspicious, so fraudulent requests can look legitimate until money moves or data is exposed.

Q: Why do vendor email accounts create fraud risk?

A: Vendor email accounts matter because they can become trusted entry points into procurement and finance workflows. If an attacker impersonates or compromises a supplier mailbox, the business may accept the message as routine, which allows fraudulent payment requests or account changes to pass through established approvals.

Q: How should security teams measure whether supplier risk monitoring is actually working?

A: Look for evidence that monitoring changes decisions. Effective programmes reduce the time between a new supplier issue and an access or remediation action, and they can show which identities, systems, and relationships were affected. If risk scores are generated but never drive segmentation, revalidation, or ticketed response, the monitoring is informational rather than operational.

Q: Who should own vendor communication risk when the attack touches finance and procurement?

A: Shared ownership is usually required. Security needs the detection and visibility layer, but finance or procurement must own the business decision because they understand whether a vendor request is normal, urgent, or outside approved process.

Technical breakdown

Why vendor communications are a governance boundary

Vendor email compromise succeeds because the recipient often trusts the relationship before verifying the sender. That makes the communication channel itself part of the identity surface, especially where vendors interact with finance, procurement, or executive assistants. The technical issue is not simply phishing syntax, but the reuse of legitimate vendor context such as domains, contacts, and prior exchanges. Once that context exists, attackers can blend into normal workflows and bypass user suspicion. Effective governance therefore depends on knowing which vendor identities are active, who they touch, and how their communication pattern changes over time.

Practical implication: treat vendor-to-employee communication as a governed identity relationship, not an informal business exception.

How continuous vendor discovery changes the attack surface

A living vendor profile turns third-party exposure into an inventory problem that can be monitored over time. Instead of relying on static lists or periodic reviews, continuous discovery tracks contacts, domains, IPs, countries, and internal users interacting with each vendor. That matters because supply-chain trust is dynamic. A new vendor contact, a changed domain, or a different activity pattern can all signal risk. The governance value comes from linking those changes to detection and response decisions before fraudulent requests move into payment or data access workflows.

Practical implication: maintain a continuously updated vendor inventory tied to communication behaviour and internal user relationships.

Why federated risk scoring matters for third-party trust

Federated intelligence lets defenders score vendor behaviour using community-level signals without exposing customer-specific data. That matters because third-party compromise rarely stays local to one organisation, and manual case-by-case review does not scale across a large supplier ecosystem. Risk scoring is useful only when it reflects actual behavioural evidence such as suspicious email patterns, compromise indicators, or impersonation attempts. In this model, the control is not just alert generation. It is the ability to change trust posture as vendor risk evolves across the broader ecosystem.

Practical implication: use federated third-party signals to adjust vendor trust levels before fraudulent requests reach business approvers.

Threat narrative

Attacker objective: The attacker aims to exploit vendor trust to trigger fraud, redirect payments, or gain a foothold inside routine business communications.

1. Entry occurs through a trusted vendor communication path, where the attacker blends into legitimate email traffic or impersonates an existing supplier relationship.
2. Credential or trust abuse follows when recipients rely on vendor familiarity and accept the request as business as usual, rather than validating the sender and context.
3. Impact is realised when the fraudulent request reaches finance, procurement, or another business process that can move money or expose sensitive information.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor email compromise is fundamentally a trust-boundary failure, not an inbox filtering problem. The article shows that attackers are not merely bypassing email controls, they are exploiting the authority embedded in vendor relationships. That shifts the governance question from message inspection to relationship visibility and verification. Security teams should treat vendor communications as a controlled identity channel, not an informal business exception.

Continuous vendor discovery is the missing control layer for third-party communications. Static supplier lists cannot capture changing contacts, domains, IPs, and internal user relationships. Without that living inventory, teams cannot see when a vendor relationship is new, altered, or unusually active. The practitioner conclusion is that third-party oversight must move from periodic review to continuous observation.

Vendor risk scoring needs behavioural evidence, not reputation labels. A useful score reflects suspicious email patterns, compromise indicators, and impersonation behaviour, not just whether a vendor is familiar. That matters because trusted vendors are often the attack path, not the control. The field should move toward evidence-based trust posture management across procurement, finance, and security workflows.

Vendor trust is now part of identity governance, even when no human account is directly compromised. Third-party relationships shape who can ask for action, who can approve it, and which requests look legitimate. That makes supplier communications part of the access model around money movement and sensitive workflows. Practitioners should govern the relationship, not only the mailbox.

Vendor exposure creates identity blast radius across business processes. When a compromised or impersonated supplier reaches multiple employees, the harm is no longer limited to one message. It propagates through internal user relationships, approvals, and downstream business actions. The implication is that teams need to measure trust propagation, not just threat volume.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Standards

What this signals

Vendor trust now behaves like an access decision. Once a supplier can reach employees with enough context to trigger action, the communication path has become part of the identity control plane. IAM teams should therefore manage vendor relationships with the same discipline they apply to other high-trust pathways, including inventory, ownership, and review.

Third-party exposure is no longer an edge case. The combination of high employee engagement and rising breach involvement means vendor abuse is now a repeatable operational pattern, not a rare anomaly. That makes continuous monitoring more valuable than periodic assurance checks, especially where approval workflows depend on email.

Supply-chain blast radius is shaped by the quality of vendor visibility. When internal teams cannot see which vendors are active, how they change, or which users they touch, attackers inherit that opacity. The practical lesson is to tighten relationship governance before adding more alerting, because alert volume does not correct blind trust.

For practitioners

• Map active vendor relationships Build a live inventory of vendors that includes contacts, domains, IPs, countries, and the internal users each vendor can reach. This gives security and IAM teams a baseline for identifying unusual communication patterns and changes in trust relationships.
• Score third-party risk continuously Use behavioural signals such as suspicious email patterns, compromise indicators, and impersonation attempts to update vendor risk in near real time. Do not rely on static risk ratings or periodic questionnaires alone.
• Validate payment and request flows Require a second verification path for vendor-driven payment changes, invoice requests, and sensitive data asks, especially when the message origin or context has changed. This reduces the chance that a trusted relationship can be abused for fraud.
• Tie vendor alerts to business ownership Route high-risk vendor events to the teams that own procurement, finance, or the relationship itself so they can decide whether the request is legitimate. Security visibility is only useful if someone can act on it.

Key takeaways

• Vendor email compromise succeeds by exploiting trusted business relationships, which turns routine communications into a fraud channel.
• The evidence points to a scaling problem, with 44% employee engagement and a sharp rise in third-party breach involvement.
• The strongest control move is continuous vendor visibility tied to ownership, so security teams can validate trust before requests turn into action.

Key terms

• Vendor Email Compromise: Vendor email compromise is a form of impersonation that targets supplier, contractor, or partner relationships. Attackers exploit routine vendor communication patterns to request payment changes, invoice redirection, or other sensitive actions, so identity and process verification must extend beyond internal users.
• Third-Party Visibility: The ability to see how external vendors, SaaS services, and outsourced providers connect to data and systems. It includes knowing what they access, how they authenticate, and whether their permissions are proportionate to the work they perform.
• Federated intelligence: Federated intelligence is a detection model that shares threat signals across participants without exposing private customer data. For identity and fraud defence, it matters because patterns seen in one tenant can improve risk scoring elsewhere, especially when attacks are low-volume and behaviourally similar.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.