Third-party risk: are patch gaps and credential leaks the real problem?

TL;DR: A supply chain that can look strong on paper while still carrying 53.77% critical vulnerability exposure and 23.34% corporate credential leakage leaves breach conditions in place before any headline event occurs, according to Black Kite’s analysis of ~200,000 vendor organisations. Baseline hygiene is not resilience when identity exposure and patch failure remain system-wide failure modes.

Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “Baseline Posture”.

By the numbers:

• 53.77% of monitored organisations show patch management failure signals across the ecosystem.
• 23.34% of organisations have corporate credentials circulating on the dark web.

Key questions

Q: What breaks when supplier patching failures and credential exposure persist across the vendor ecosystem?

A: The failure is not a single compromised vendor, but a reusable attack surface that lets the same weakness be exploited across many connected organisations.

Q: Why do high vendor security scores not guarantee lower third-party risk?

A: Because a score measures observable hygiene, not whether current exposures are already present in the environment.

Q: How can security teams tell whether a supplier is becoming a concentration risk?

A: Look for the overlap of susceptibility, patch failure, and identity exposure across the same sector or dependency chain.

Practitioner guidance

• Tighten third-party exposure screening Require suppliers to clear live checks for critical vulnerabilities, credential exposure, and patch failure before they receive or retain access.
• Separate hygiene scores from trust decisions Use cyber grades as a coarse filter only, then base access approvals on current exposure signals and remediation evidence.
• Treat exposed credentials as an offboarding trigger If a supplier’s corporate credentials appear in stealer logs, revoke or constrain related access paths until the identity footprint is revalidated.

Bottom line: The article shows that supply chain weakness is often structural, with patch failure and exposed credentials combining into repeatable attack conditions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →