Topic starter
11/07/2026 8:22 pm
TL;DR: Third-party dependencies now account for over 35% of data breaches and more than 40% of ransomware starts, according to SecurityScorecard, while AI and shadow AI are lowering attacker effort and widening exposure across enterprise workflows. The governance challenge is no longer internal control alone, but visibility and accountability across the extended digital supply chain.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “As AI Transforms Business, Dr. Aleksandr Yampolskiy Explains on NASDAQ TradeTalks Why the CISO Role Has Never Been More Complex”.
By the numbers:
- Over 35% of data breaches now stem from third parties, according to SecurityScorecard research.
- Over 40% of ransomware originates with a third party, according to SecurityScorecard research.
Key questions
Q: What breaks when third-party access is treated as a one-time procurement issue?
A: Lifecycle control breaks.
Q: Why does shadow AI create such a high breach risk?
A: Shadow AI creates high breach risk because it can access sensitive data outside normal oversight, then process or reproduce that data in places security teams do not control.
Q: What are the warning signs that AI governance is becoming a control gap?
A: The warning signs are fragmented inventories, undocumented OAuth grants, unclear ownership of AI tools, and inconsistent evidence for what each system can access.
Practitioner guidance
- Map all third-party access paths Inventory vendor, partner, and contractor accounts, tokens, API keys, and federated connections, then assign an owner and expiry rule to each path.
- Govern shadow AI as an access problem Track approved and unapproved AI tools, identify which identities can use them, and block sensitive-data transfer where policy or legal review is absent.
- Separate board reporting from operational reporting Present third-party concentration, AI usage exposure, and trust-boundary exceptions in board language that ties risk to business dependencies.
Bottom line: Third-party access and shadow AI are now governance issues that sit alongside traditional internal security controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:52 pm
Third-party access is now an identity governance problem, not only a supplier risk problem. When vendors, partners, and contractors can authenticate into the environment, the control question shifts from procurement to lifecycle governance. Organisations need ownership, review, and revocation for every delegated access path, because the security boundary now includes external identities as well as internal ones.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should own third party risk management across security, legal, and procurement?
A: One accountable owner should coordinate the end-to-end vendor lifecycle, even if multiple functions perform different checks. Security can validate technical controls, procurement can manage commercial terms, and legal can govern contract language, but a single owner is needed to ensure findings become action.
👉 Read our full editorial: Third-party and AI risk are reshaping the CISO mandate