Notifications
Clear all
Topic starter
18/08/2026 2:41 pm
TL;DR: Third-party cyber risk is now a vendor lifecycle issue, not just a procurement concern, because external access expands the attack surface and can drive data loss, operational disruption, and compliance exposure, according to Jscrambler. Vendor risk management only works when security, legal, and offboarding controls are tied to continuous monitoring and access removal.
NHIMG editorial — based on content published by Jscrambler: Vendor Risk Management and Third-Party Cyber Risk
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
Questions worth separating out
Q: How should security teams govern vendor access across the third-party lifecycle?
A: Security teams should govern vendor access as a lifecycle, not a one-time approval.
Q: Why do vendor access workflows often fail at offboarding?
A: They fail because offboarding is usually treated as an administrative closeout instead of a technical deprovisioning event.
Q: What do security teams get wrong about vendor risk scoring?
A: The common mistake is treating the score as documentation instead of a decision trigger.
Practitioner guidance
- Build vendor identity inventories Record every third-party account, token, certificate, API key, and delegated permission tied to each vendor relationship, then assign an owner for every identity.
- Tie offboarding to technical revocation Make vendor termination incomplete until access is revoked across applications, cloud environments, secrets stores, and any shared admin or support channels.
- Score vendors by access blast radius Prioritise reviews for vendors with production access, regulated data access, or privileged integrations, because those relationships create the highest downstream impact.
What's in the full article
Jscrambler's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step vendor risk management workflow from identification through offboarding
- PCI DSS compliance context for merchants handling payment data and vendor oversight
- A breakdown of how automation can streamline vendor compliance analysis
- The article's full discussion of risk categories such as financial, operational, reputational, and legal exposure
👉 Read Jscrambler's analysis of third-party cyber risk and vendor risk management →
Third-party cyber risk: what it means for vendor governance teams?
Explore further
18/08/2026 3:25 pm
Third-party cyber risk is really identity lifecycle risk in disguise. Once a vendor receives system access, the core governance question becomes who controls that access, how it is bounded, and when it is removed. That is an IAM and NHI problem as much as a procurement problem. Organisations that separate vendor oversight from access governance create blind spots around credentials, delegated permissions, and service accounts. The practitioner takeaway is to manage vendors through the same lifecycle discipline used for privileged identities.
A question worth separating out:
Q: Who is accountable when a vendor compromise creates internal access risk?
A: Accountability sits with both the business owner of the integration and the identity team that approved the trust path. Procurement may own the contract, but IAM owns the access relationship. If the downstream system still trusts the supplier after compromise, the governance gap is in access design as much as in vendor oversight.
👉 Read our full editorial: Third-party cyber risk is becoming a core vendor governance issue
