Topic starter
12/07/2026 12:27 pm
TL;DR: 100% of Singapore’s top 100 companies were affected by at least one third-party cyber breach in the past year, while only 5% suffered a direct breach and firms with an “A” rating saw 93% no known breach rates, according to SecurityScorecard’s State of Cyber Resilience in Singapore. The finding shows supply chain oversight has become a board-level control problem, not just a vendor management exercise.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “The State of Cyber Resilience in Singapore”.
By the numbers:
- 100% of Singapore’s top 100 companies experienced at least one third-party breach in the past year.
- Only 5% of Singapore’s top 100 companies suffered a direct breach, primarily caused by malware infections.
- Companies with an “A” cybersecurity rating saw 93% no known breach rates.
Key questions
Q: What breaks when non-human access is left outside IAM controls?
A: Healthcare teams lose visibility into who or what changed data, touched records, or moved through administrative workflows.
Q: Why do strong internal security ratings not prevent supplier-driven breaches?
A: Because internal ratings measure your own posture, not the trust chains created by vendors and their dependencies.
Q: What are the signs that third-party identity access is too broad?
A: Warning signs include suppliers that can read more user metadata than they need, support accounts with persistent access, and recovery workflows that bypass normal governance.
Practitioner guidance
- Map external identity paths Inventory every third-party and fourth-party access path into critical systems, including federated logins, service accounts, tokens, and API keys.
- Review supplier offboarding controls Test whether terminated suppliers still retain valid credentials, active integrations, or data access routes in production and non-production environments.
- Tie access reviews to business owners Assign explicit internal ownership for each external account, integration, and data-sharing relationship so that reviews have a clear accountable approver.
Bottom line: Third-party exposure can dominate enterprise breach risk even when internal security posture appears strong.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:40 pm
Third-party exposure is now a core identity governance problem, not a procurement problem. When organisations connect suppliers through federated access, API keys, service accounts, and shared data workflows, they are extending their identity perimeter beyond their direct control. The finding that every top Singapore company saw third-party breach exposure shows that internal ratings alone do not define resilience. Practitioners should treat supplier access as governed identity infrastructure, not as static vendor due diligence.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable for third-party cyber risk under a shared-responsibility model?
A: Accountability should sit with the business owner of the relationship, supported by security, IAM, and procurement. Security defines the control baseline, but the business function that depends on the supplier must own the risk decision, the access approval, and the offboarding outcome. Without that split, external access tends to persist by default.
👉 Read our full editorial: Singapore’s top companies face universal third-party breach exposure