Topic starter
12/07/2026 12:24 pm
TL;DR: Supply chain risk now extends through vendors, vendors’ vendors, and shadow AI, with SecurityScorecard’s CEO warning that a small cluster of providers supports a large share of the global attack surface. Compliance alone no longer maps to resilience, and continuous monitoring plus objective cyber KPIs are becoming central to systemic risk management.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “Cyber Focus Interview: Dr. Aleksandr Yampolskiy Analyzes the Rise of Third-Party and Supply Chain Cyber Risks”.
Key questions
Q: What breaks when third-party access is not mapped end to end?
A: When third-party access is not mapped end to end, organisations lose sight of who can still reach internal systems after the original business purpose changes.
Q: Why do vendors' vendors create a larger security problem than simple supplier risk?
A: Because the same upstream failure can affect many organisations at once.
Q: How can security teams know whether third-party risk management is working?
A: Look for evidence that inventory, review, monitoring, and revocation are all connected.
Practitioner guidance
- Inventory the full supplier trust chain Extend inventory beyond direct vendors to fourth- and fifth-party dependencies, hosted services, integrations, and delegated access paths that can inherit exposure.
- Treat shadow AI as an access-control issue List unapproved AI tools, identify what data users share with them, and determine whether enterprise accounts, tokens, or connectors are involved.
- Measure supplier exposure with objective KPIs Track concentration risk, active access paths, and response time for high-impact suppliers rather than relying only on audit status or compliance checklists.
Bottom line: Third-party risk now extends into nested suppliers, shared platforms, and shadow AI tools that can expand one compromise into many downstream exposures.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Third-party risk has become a governance chain, not a vendor list. The article is right to frame exposure across third, fourth, and fifth parties, because the real control problem is cascading trust. A supplier map that stops at direct contracts misses the identities, tokens, and hosted dependencies that actually carry access. Practitioners should treat the full trust chain as part of the attack surface, not an adjacent procurement record.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when shadow AI tools connect to business systems?
A: Treat the connection as delegated access and review the tokens, credentials, and permissions involved. If the tool can read, write, or move sensitive data, it belongs in identity governance and NHI oversight, not just application inventory. The practical test is whether the access can be approved, monitored, and revoked like any other service relationship.
👉 Read our full editorial: Third-, fourth- and fifth-party risk is reshaping cyber exposure