Topic starter
25/10/2026 11:03 am
TL;DR: 53.77% critical vulnerability exposure and 23.34% credential leakage show recurring supplier failure, in Black Kite’s survey of roughly 200,000 vendor organisations. Third-party risk programs need live exposure checks and identity governance, not averages that can hide active compromise conditions.
Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “Baseline Posture”.
By the numbers:
- 53.77% of monitored organisations show patch management failure signals across the ecosystem.
- 23.34% of organisations have corporate credentials circulating on the dark web.
Key questions
Q: Why do high vendor security scores not guarantee lower third-party risk?
A: Because a score measures observable hygiene, not whether current exposures are already present in the environment.
Q: How can security teams tell whether a supplier is becoming a concentration risk?
A: Look for the overlap of susceptibility, patch failure, and identity exposure across the same sector or dependency chain.
A: The failure is not a single compromised vendor, but a reusable attack surface that lets the same weakness be exploited across many connected organisations.
Practitioner guidance
- Tighten third-party exposure screening Require suppliers to clear live checks for critical vulnerabilities, credential exposure, and patch failure before they receive or retain access.
- Separate hygiene scores from trust decisions Use cyber grades as a coarse filter only, then base access approvals on current exposure signals and remediation evidence.
- Treat exposed credentials as an offboarding trigger If a supplier’s corporate credentials appear in stealer logs, revoke or constrain related access paths until the identity footprint is revalidated.
Bottom line: The article shows that supply chain weakness is often structural, with patch failure and exposed credentials combining into repeatable attack conditions.
Glossary terms: Third Party Risk, Ransomware Susceptibility Index, Credential exposure, Pressure Zone
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:15 pm
Baseline posture is not resilience. A high external grade can coexist with conditions that make breach propagation easy, and that is the central governance problem in third-party ecosystems. The article shows that supply chain risk is concentrated where hygiene metrics and active exposure signals diverge. Practitioners should stop treating vendor scores as a proxy for real trust and instead govern the exposure that sits underneath them.
A few things that frame the scale:
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
A: No, not without revalidating the supplier’s identity footprint and access scope. Circulating credentials mean the trust boundary has already weakened, even if no breach has been publicly declared. The right response is to constrain or revoke related access, re-check authentication paths, and confirm that the supplier can still control its own identities.
👉 Read our full editorial: Third-party risk is concentrated in patching and credential exposure
This post was modified 7 days ago by NHI Mgmt Group