Topic starter
12/07/2026 12:18 pm
TL;DR: Third- and fourth-party breaches are already widespread, and poorly rated organisations are 13x more likely to be breached, according to SecurityScorecard. External access now needs continuous oversight, because stale supplier trust can create active risk paths.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “How to Prepare for the UK Cyber Security and Resilience Bill in 2025”.
By the numbers:
- 97% of the UK’s top companies have already experienced third- and fourth-party breaches.
- Companies with poor ratings are 13x more likely to be breached.
Key questions
Q: Why does the UK Cyber Security and Resilience Bill increase pressure on external access governance?
A: Because it pushes organisations to prove they know which suppliers can affect critical services, how incidents will be reported, and where accountability sits.
Q: What are the signs that vendor oversight is not working?
A: Look for vendors with unclear owners, dormant accounts, duplicate access paths, expired approvals, unresolved exceptions, and reassessment cycles that do not change permissions.
Q: Where does third-party risk fail in practice when suppliers have privileged access?
A: It fails when organisations treat supplier assurance as a point-in-time exercise instead of a live access problem.
Practitioner guidance
- Build a live inventory of third-party access Track every supplier, MSP, and sub-processor with authentication or administrative reach into production systems, then assign an internal owner for each relationship.
- Classify suppliers by access criticality Rank external parties by the systems, data, and privilege levels they can reach so incident reporting and review effort follow actual blast radius.
- Review privileged external sessions continuously Move beyond annual questionnaires and verify whether remote admin paths, service credentials, and support accounts are still necessary and monitored.
Bottom line: Third-party exposure is already widespread, so resilience programmes need continuous oversight rather than periodic supplier check-ins.
Glossary terms: Third Party Risk, Managed Service Provider, Supply Chain Security Debt, Incident Reporting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 42 minutes ago by NHI Mgmt Group
12/07/2026 12:31 pm
Third-party risk is now an identity governance problem, not just a supplier assurance problem. Once suppliers, MSPs, and downstream vendors can act inside an environment, their access behaves like any other privileged access relationship. That means lifecycle control, entitlement scope, and revocation speed matter more than contract language alone. Practitioners should govern external access as part of the identity plane, not as a separate procurement workflow.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations implement continuous third-party monitoring in vendor risk programmes?
A: Organisations should treat continuous monitoring as the operating layer of third-party risk management, not a replacement for due diligence. Use questionnaires and point-in-time assessments to establish baseline risk, then continuously watch for changes in exposure, posture, and externally visible weaknesses. The goal is faster detection, faster remediation, and better vendor selection based on current security signals, not stale snapshots.
👉 Read our full editorial: UK cyber security and resilience bill shifts third-party risk