Notifications
Clear all
Topic starter
19/08/2026 3:23 pm
TL;DR: April’s security losses were driven less by clever code than by compromised identities, third-party trust, and rapidly exploitable infrastructure gaps, according to Quantstamp’s April 2026 Security Beat. The month also reinforced that AI agents and supply chains now extend the attack surface far beyond traditional perimeter controls, making governance and dependency visibility the decisive issues.
NHIMG editorial — based on content published by Quantstamp: April 2026 Security Beat: Same Actors, New Targets
By the numbers:
- $635.24M was lost across 28 crypto incidents in April, with smart contract failures accounting for $328.14M.
- A compromised NHI averaged 2.7 separate incidents in the past 12 months, according to Oasis Security & ESG.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to Astrix Security & CSA.
Questions worth separating out
Q: What breaks when third-party access is not included in identity governance?
A: Auditability breaks first, followed by containment.
Q: Why do malicious packages and dependency updates create such a large security risk?
A: Because build systems and developers trust upstream artefacts by default.
Q: How do security teams know whether an AI agent is operating safely?
A: Security teams know an AI agent is operating safely when its permissions, invoked tools, and accessed data remain consistent with the approved use case over time.
Practitioner guidance
- Map external trust relationships to privileged outcomes Inventory every vendor, contractor, and integrated service that can read code, access keys, or trigger deployment actions.
- Treat package-maintainer compromise as a privileged-access event Pin dependencies, enforce lockfile integrity in CI, and alert on new versions of critical packages before they enter production builds.
- Reduce blast radius around admin actions Use multisig, geographically distributed signers, and timelocks for high-risk actions so a single compromised identity cannot move assets immediately.
What's in the full article
Quantstamp’s full announcement covers the incident-by-incident detail this post intentionally leaves at the analysis level:
- Per-incident breakdown of the April crypto losses, including the Kelp and Drift Protocol events
- The Axios supply chain compromise timeline, including maintainer takeover and malicious package versions
- The Vercel third-party breach summary, including the access keys and credentials reportedly exposed
- The full list of active CVEs and the mitigation notes tied to each exploitation case
👉 Read Quantstamp’s April 2026 Security Beat on identity, supply chain, and agent risk →
April security beat: what this month says about trust and access?
Explore further
19/08/2026 4:08 pm
Third-party trust has become an identity governance problem, not just a vendor risk issue. The report shows that attackers can enter through suppliers, tooling integrations, and contractor relationships with enough privilege to bypass perimeter logic. That means access governance must extend to external identities, not stop at employee IAM. The practical conclusion is that every delegated trust path needs lifecycle, entitlement, and revocation discipline.
A question worth separating out:
Q: Who is accountable when a third-party identity causes data exposure?
A: Accountability sits with the organisation that trusted the identity without sufficient boundaries, not just with the vendor that used it. If a third-party account was over-scoped, persistently trusted, or insufficiently monitored, the governance failure is internal. Frameworks such as NIST CSF and zero trust both expect explicit control over external access.
👉 Read our full editorial: April security beat: identity, supply chain and agent risk
