Topic starter
20/08/2026 6:01 pm
TL;DR: Cybersecurity third-party risk management is failing where questionnaires stop and real access begins, according to Strac, because vendor risk is defined by what data and systems a third party can actually reach, not what it claims in a security review. Programs that do not map blast radius, assess controls, and monitor continuously will keep underestimating breach impact.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Cybersecurity Third-Party Risk Management: 2026 Guide”.
Key questions
Q: How should security teams assess third-party cyber risk beyond questionnaires?
A: They should measure real access first.
Q: Why do weak segmentation and vendor access increase breach impact so much?
A: They increase breach impact because they expand the attacker's reachable surface after initial access.
Q: What are the signs that third-party risk management is not working well enough?
A: A weak program usually shows up as duplicate manual reviews, slow follow-up on vendor issues, and mismatches between questionnaire answers and external risk signals.
Practitioner guidance
- Map vendor blast radius first Inventory every vendor, SaaS app, and AI tool by the exact data sets, systems, and workflows it can reach, then rank risk by actual exposure rather than questionnaire score.
- Govern third-party identities like internal ones Assign an owner, expiry, and revocation path to each external login, token, API key, or delegated session so access does not persist beyond the business need.
- Continuously monitor vendor changes Track vendor breaches, certification expiry, and permission drift so a point-in-time review does not become stale before the next renewal cycle.
Bottom line: Third-party cyber risk is best understood as reachable data exposure, not as a score on a vendor questionnaire.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:39 pm
Data reach is the real unit of third-party risk: questionnaire scores matter less than the assets a vendor can actually touch. When programs rank vendors by paperwork, they miss the practical blast radius that determines breach impact. That is a governance failure, not just a measurement gap. Practitioners should build third-party risk around reachable data, not declared control maturity.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat third-party access as a privileged identity risk?
A: Yes, because third-party access often bypasses the same scrutiny applied to internal users while still reaching sensitive systems. Organisations should classify external accounts by privilege, require attestation, and remove access when the business need ends. If a supplier or integrator can alter records or administer systems, that access belongs in privileged governance.
👉 Read our full editorial: Cybersecurity third-party risk management is really data reach