Topic starter
23/10/2026 12:47 am
TL;DR: Questionnaires can miss real exposure and active access paths, and Black Kite reports that this leaves third-party risk harder to govern than teams expect. Vendor monitoring needs evidence, thresholds and escalation paths to surface issues before they become material.
Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “Four Steps to Build a Proactive Third-Party Cyber Risk Management Program”.
Key questions
Q: How should security teams handle vendor risk when access is persistent or machine-driven?
A: Treat third-party access as a lifecycle control, not a one-time approval.
Q: What are the signs that third-party monitoring is not working well?
A: Common warning signs include stale assessment data, repeated surprises during reviews, broad questionnaires that do not reflect actual risk, and reassessments driven only by the calendar.
Q: Why do third-party risk programmes break down when they rely on questionnaires alone?
A: Questionnaires create administrative coverage but often miss the operational evidence that matters most, such as real exposure, active access paths and remediation speed.
Practitioner guidance
- Replace generic questionnaires with evidence-led intake Collect OSINT, targeted attestations and technical evidence that can be validated against the vendor's actual exposure and access patterns.
- Set risk thresholds for continuous vendor monitoring Define alert thresholds for score movement, exposure spikes and vulnerability changes so the team only escalates material shifts.
- Tie third-party access to lifecycle offboarding Require explicit review points for vendor accounts, tokens and support access so dormant access is removed when the relationship changes.
Bottom line: Third-party cyber risk becomes harder to govern when teams rely on questionnaires that do not prove what is actually exposed or who can still access it.
Glossary terms: Third-Party Cyber Risk, Risk intelligence, Continuous Monitoring, Third-Party Offboarding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Third-party risk programmes fail first at signal quality, not at policy design. Organisations usually have enough policy language to describe vendor expectations, but they do not have enough trustworthy evidence to make decisions at scale. Questionnaires create coverage, not clarity, and coverage alone does not surface credential exposure, inherited access or dormant integrations. The practitioner conclusion is that vendor oversight must be built around actionable intelligence, not administratively complete forms.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable when a vendor or subcontractor causes a security issue?
A: Accountability should sit with the business owner, security team, procurement, and the vendor relationship owner together, because hidden third-party risk crosses all of them. Contracts define obligations, but identity and access teams must enforce the operational controls that keep those obligations real. Shared ownership is the only workable model.
👉 Read our full editorial: Proactive third-party cyber risk needs actionable intelligence
This post was modified 6 days ago by NHI Mgmt Group