Topic starter
10/07/2026 9:27 pm
TL;DR: Vendor lifecycle visibility gaps are leaving third-party risk fragmented, with Drata citing Zylo’s finding that the average company manages 305 SaaS applications and Verizon reporting that 30% of breaches involved third parties in 2025, up from 15% the year before. Point-in-time reviews and manual spreadsheets no longer contain vendor exposure once onboarding, access persistence, and offboarding drift out of sync.
Editorial analysis by NHI Mgmt Group, based on content published by Drata: “Risk Management Across the Vendor Lifecycle”.
By the numbers:
- According to Zylo research cited by Drata, the average company manages 305 SaaS applications.
Key questions
A: Risk grows faster than oversight.
Q: Why do point-in-time vendor reviews miss real third-party risk?
A: Because vendor posture changes after onboarding.
Q: What breaks when vendor offboarding is not verified?
A: Orphaned access survives.
Practitioner guidance
- Map every third-party relationship end to end Create a single inventory that connects intake, risk review, contract status, live access, and offboarding for each vendor.
- Tie access grants to explicit lifecycle events Require a named approval and expiration point for every vendor account, OAuth grant, token, or API key issued during onboarding.
- Automate offboarding checks across systems Verify that termination workflows revoke SaaS access, disable integrations, remove dormant accounts, and close any residual dependency paths across identity, SaaS, and cloud platforms.
Bottom line: Third-party risk grows when vendor governance is fragmented across procurement, security, legal, and operations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:49 pm
Vendor lifecycle visibility is the missing governance layer in third-party risk programmes. Most organisations still treat due diligence as the control, when in reality it is only the entry point. The real risk accumulates after onboarding, as business use expands, access changes, and termination becomes incomplete. Practitioners should view lifecycle visibility as the mechanism that keeps third-party risk bounded across the full relationship.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should third-party access be governed like an identity lifecycle issue?
A: Yes. Once a vendor has authenticated access, the organisation is managing an external identity with a lifecycle of its own, including issuance, approval, review, and revocation. Treating it as a procurement-only problem leaves accounts, tokens, and integrations outside proper ownership and makes residual privilege much harder to remove.
👉 Read our full editorial: Vendor lifecycle visibility gaps are expanding third-party risk