Topic starter
20/08/2026 6:01 pm
TL;DR: Vendor access, not questionnaire scores, is the real measure of third-party risk, with Strac arguing that reachable data and systems define exposure. Identity governance has to track inventory, ownership, revocation, and monitoring or vendor access will outgrow the controls around it.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “Cybersecurity Third-Party Risk Management: 2026 Guide”.
Key questions
Q: Why do weak segmentation and vendor access increase breach impact so much?
A: They increase breach impact because they expand the attacker's reachable surface after initial access.
Q: What are the signs that third-party risk management is not working well enough?
A: A weak program usually shows up as duplicate manual reviews, slow follow-up on vendor issues, and mismatches between questionnaire answers and external risk signals.
Q: How should security teams assess third-party cyber risk beyond questionnaires?
A: They should measure real access first.
Practitioner guidance
- Map vendor blast radius first Inventory every vendor, SaaS app, and AI tool by the exact data sets, systems, and workflows it can reach, then rank risk by actual exposure rather than questionnaire score.
- Govern third-party identities like internal ones Assign an owner, expiry, and revocation path to each external login, token, API key, or delegated session so access does not persist beyond the business need.
- Continuously monitor vendor changes Track vendor breaches, certification expiry, and permission drift so a point-in-time review does not become stale before the next renewal cycle.
Bottom line: Third-party cyber risk is best understood as reachable data exposure, not as a score on a vendor questionnaire.
Glossary terms: Third-Party Blast Radius, Vendor Reach, Shadow AI, Third-Party Identity Lifecycle
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
20/08/2026 6:39 pm
Data reach is the real unit of third-party risk: questionnaire scores matter less than the assets a vendor can actually touch. When programs rank vendors by paperwork, they miss the practical blast radius that determines breach impact. That is a governance failure, not just a measurement gap. Practitioners should build third-party risk around reachable data, not declared control maturity.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat third-party access as a privileged identity risk?
A: Yes, because third-party access often bypasses the same scrutiny applied to internal users while still reaching sensitive systems. Organisations should classify external accounts by privilege, require attestation, and remove access when the business need ends. If a supplier or integrator can alter records or administer systems, that access belongs in privileged governance.
👉 Read our full editorial: Third-party risk management fails when access beats questionnaires
This post was modified 1 day ago by NHI Mgmt Group