Topic starter
12/07/2026 12:23 pm
TL;DR: Third-party events accounted for 35.5% of breaches in SecurityScorecard's 2025 Global Third-Party Breach Report, with healthcare, MOVEit-related cascading exposure, and Microsoft 365 password-spraying campaigns showing how credentials, vendor access, and shared infrastructure turn isolated incidents into enterprise-wide risk. The governance lesson is that perimeter-only thinking fails once access is delegated, reused, or inherited across vendors and workloads.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “Recent Data Breach Examples”.
By the numbers:
- 35.5% of breaches originated from third-party events, according to SecurityScorecard’s 2025 Global Third-Party Breach Report.
- The report says third-party breaches increased by 6.5% from 2023.
- Healthcare accounted for 242 total breaches, or 24.2% of all security incidents analyzed.
Key questions
Q: What breaks when third-party access is not governed as part of identity lifecycle management?
A: Access can outlive the business relationship that justified it, which leaves external identities active after need has ended.
Q: Why do third party weaknesses and stolen credentials so often turn into large scale data breaches?
A: Third party weaknesses and stolen credentials matter because attackers need only one weak entry point to reach sensitive systems and data.
Q: What are the signs that vendor privileged access is being managed unsafely?
A: Common warning signs include shared vendor passwords, standing access that never expires, missing session logs, and vendors using unmanaged devices or personal email accounts.
Practitioner guidance
- Map delegated access paths across vendors Inventory every third party that can authenticate to your environment, then record the identities, privileges, data scopes and offboarding owners attached to each one.
- Remove legacy authentication from third-party access Block non-interactive or weak authentication flows where vendors still rely on them, and treat those paths as high-risk until they are retired.
- Tie third-party offboarding to credential revocation Make contract termination, role change and inactivity trigger immediate removal of tokens, secrets, VPN access and federated sessions.
Bottom line: Third-party breaches are not just vendor incidents. They are identity governance failures when delegated access, reused credentials and inherited trust are not tightly controlled.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
Third-party risk is now an identity governance problem, not just a vendor-management problem. The article’s core evidence shows that breach propagation depends on who can authenticate, what they can reach and how quickly their access is revoked. That pushes third-party oversight into IAM, PAM and NHI lifecycle controls rather than leaving it in procurement or questionnaire workflows. Practitioners should treat delegated trust as an access-control boundary with measurable governance.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
A question worth separating out:
Q: When should security teams prioritise vendor identity governance over additional perimeter controls?
A: When the business depends on third-party platforms that can access sensitive data or operational workflows. Adding more perimeter tooling will not close the gap if suppliers, help desks, or outsourced contact centres already sit inside the trust model. In that situation, access governance and supplier oversight deliver more value than another boundary control.
👉 Read our full editorial: Third-party breach patterns show where credential and vendor risk converge