Vendor security assessments need access control, not just questionnaires

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Securden's blog post: Vendor security assessments fail when they focus on questionnaires instead of the access vendors actually hold inside an organisation.

Why it matters: It matters because IAM, PAM, and third-party access teams need evidence of scoped, monitored, and revocable access, not just vendor attestations, to limit blast radius and satisfy audit demands.

Context

Vendor security assessment is often treated as a questionnaire-led diligence exercise, but the operational control point sits elsewhere: the access a vendor receives, how that access is constrained, and how quickly it is revoked. In practice, the security posture that matters is not only what a supplier says about itself, but what it can actually do inside your environment.

That makes vendor access governance a shared IAM and PAM concern, not a procurement-only task. Once third-party access exists, teams need evidence for scope, session activity, and revocation, because those are the mechanics that reduce blast radius when a supplier account, token, or remote session is abused.

The article frames Securden as the mechanism for that control layer, but the governance point is broader than any one platform: assessments that stop at documents miss the live access layer where compromise becomes impact. That is a typical failure pattern in third-party access programmes, not an edge case.

Key questions

Q: What breaks when vendor risk assessments rely only on questionnaires and static documents?

A: They become slow, inconsistent, and easy to game. Self-reported answers can miss real exposure, while long reports and DPAs delay decisions. The result is stale ratings, weak remediation tracking, and a false sense of confidence. Effective programmes combine evidence review with continuous monitoring and periodic reassessment.

Q: Why do fourth-party vendors increase access risk so quickly?

A: Fourth-party relationships extend your trust boundary beyond the supplier you contract with. That creates loss of direct visibility, weaker enforcement of your requirements, and more difficulty proving where data goes. The risk rises when pass-through obligations, audit rights, and data mapping are missing or inconsistent.

Q: What are the signs that vendor access governance is failing?

A: Common signals include long-lived support privileges, unclear ownership of vendor accounts, inconsistent offboarding, and access paths that reach multiple systems without segmentation. If a third party can move from a support workflow into identity or data systems with little friction, governance is already weaker than it appears.

Q: How should security teams govern vendor access across the full lifecycle?

A: Security teams should govern vendor access from onboarding through offboarding, with explicit ownership, expiry, review, and revocation steps. The key is to link access to a business purpose and then remove or narrow it as soon as that purpose changes. Without lifecycle controls, third-party identities become persistent trust paths instead of bounded relationships.

Technical breakdown

Why questionnaires do not prove vendor access control

Questionnaires describe intent, not enforcement. A vendor can answer that it restricts access, rotates credentials, or monitors activity, yet those claims do not show whether sessions are scoped, time-limited, or auditable in practice. The security gap is the difference between self-attested posture and enforceable control. In third-party access programmes, the relevant evidence lives in approval records, session logs, command history, and revocation events, not in policy language. Practical implication: assess the control layer that governs actual access, not just the vendor's declared security process.

Practical implication: use assessment evidence that proves access was granted, bounded, observed, and removed.

How third-party access changes the assessment boundary

Third-party access turns vendor security assessment into a live entitlement problem. A supplier may be well governed on paper, but once its users, service accounts, or remote operators enter your environment, the material risk comes from privilege scope, credential handling, and persistence. That is why access management belongs inside the assessment boundary: it defines how much damage an external compromise can cause. Session recording, just-in-time access, and automatic revocation convert a static questionnaire into an operational control story. Practical implication: bring entitlement scope and session evidence into the vendor review itself.

Practical implication: fold vendor access scope and session evidence into the assessment boundary.

Why access evidence matters more than attested controls

Access evidence is the difference between governance and hope. If you can show who accessed what, when they accessed it, and what they did, you have a basis for audit, incident response, and vendor accountability. If you only have questionnaire responses, you cannot demonstrate containment or investigate misuse with confidence. This is especially important where vendors work through remote sessions or privileged credentials, because those pathways create the largest blast radius. Practical implication: retain session records and revocation trails as part of the vendor assessment record.

Practical implication: retain session records and revocation trails as assessment evidence.

Breaches seen in the wild

• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.
• Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Vendor security assessment is a control problem, not a documentation problem: questionnaires can support due diligence, but they do not enforce boundaries. The live risk is whether a third party can reach systems, elevate privilege, and leave a trace that can be reviewed after the fact. Practitioners should treat access governance as the evidence layer that makes assessment real.

Third-party access is where supply chain risk becomes operational: the supplier's own posture matters, but the organisation's control over granted access determines blast radius. That shifts the programme from passive assurance to active entitlement management, where scoping, monitoring, and revocation are the primary controls. Security teams should judge vendors by the access they are allowed to exercise, not just by the answers they submit.

Session evidence is the missing proof point in most vendor reviews: if access cannot be tied to a user, a time window, and recorded activity, the assessment has no operational verification. This is the part of the process that converts policy into auditability. Practitioners should make recorded sessions and revocation logs part of the minimum acceptable evidence set.

Access assessment belongs inside vendor lifecycle governance: onboarding, approval, monitoring, and offboarding are the points at which vendor risk becomes manageable or persistent. The access lifecycle is the control plane for third-party trust, and the absence of lifecycle discipline is what turns a vendor relationship into long-lived exposure. Teams should align vendor security review with access lifecycle checkpoints, not with a one-time questionnaire.

Identity blast radius is the right concept for vendor access programmes: the question is not whether a vendor is trusted in general, but how far a compromised vendor identity can move if it is used maliciously. That framing connects PAM, IGA, and third-party risk into one governance model. Practitioners should design assessments around limiting blast radius, not around collecting more attestations.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Identity blast radius is the key programme metric for vendor access: the real question is how far a third-party identity can move if it is abused, not whether the vendor completed a security questionnaire. That means IAM, PAM, and third-party risk teams need a shared view of scope, session evidence, and revocation outcomes.

Assessment programmes should separate claims from control proof. A questionnaire can tell you what a vendor says, but only entitlement records and session logs tell you whether the access model is actually constrained inside your environment.

Organisations that treat vendor access as a lifecycle control, not a document collection exercise, will have a much clearer path to auditability and incident containment.

For practitioners

• Define access as the assessment boundary Require every vendor review to include the systems, accounts, and sessions the vendor can actually touch, not just the questionnaire response set. Use that boundary to determine whether the vendor can alter data, reach administrative functions, or persist after engagement ends.
• Capture session evidence as standard artefact Store approval trails, session recordings, and command history with the vendor record so auditors and incident responders can reconstruct what happened without relying on vendor self-attestation.
• Tie revocation to the vendor lifecycle Make access removal a required offboarding step and verify that credentials, tokens, and remote paths are removed when the relationship or scope changes.
• Separate posture claims from control proof Use questionnaires to collect claims, then validate those claims against entitlement scope, recorded sessions, and revocation logs before approval.
• Treat third-party access as privileged access Apply PAM-style controls to vendor operators who can reach production systems, including least privilege, time-limited access, and monitored sessions.

Key takeaways

• Vendor security assessments fail when they measure supplier posture without proving how third-party access is actually constrained inside the environment.
• The practical risk is blast radius, because a vendor compromise becomes materially worse when access is broad, persistent, or poorly monitored.
• Assessment programmes need session evidence, scoped entitlements, and verified revocation to turn due diligence into enforceable governance.

Key terms

• Vendor access governance: Vendor access governance is the set of policies and controls that define, limit, review, and revoke external user or system access. It focuses on lifecycle, scope, evidence, and accountability, so third-party identities do not become permanent or overly broad trust paths.
• Session evidence: Session evidence is the record of what an identity actually did after access was granted, including commands, queries, configuration changes, and resource actions. It is the proof layer that lets security and compliance teams reconstruct activity, investigate incidents, and validate that privilege did not exceed policy.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-Party Entitlement: Access granted to a vendor, supplier, or service provider that lets an external party reach internal systems or data. In identity governance, the key issue is not the existence of the entitlement but whether it still has a current owner, purpose, and offboarding path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.