Topic starter
11/07/2026 8:41 pm
TL;DR: Third-party involvement, vulnerability exploitation, and unsanctioned GenAI use stand out in Verizon's 2025 DBIR analysis, ColorTokens reports. Identity governance now has to cover suppliers, exposed assets, and employee AI behavior at the same time.
Editorial analysis by NHI Mgmt Group, based on content published by ColorTokens: “2026: Bringing Cyber Resiliency to Organizations”.
By the numbers:
- Third-party involvement was a factor in 30% of all breaches this year, according to Verizon.
- The exploitation of vulnerabilities accounted for 20% of all breaches, overtaking phishing at 15%, according to Verizon.
- Of employees using GenAI on corporate devices, 72% used a personal email for their account, according to Verizon.
Key questions
Q: Why do edge vulnerabilities create such a different risk profile from ordinary patchable flaws?
A: Internet-facing assets can be exploited before normal patch windows close, so the issue becomes how much reachable surface remains after disclosure.
Q: What are the signs that employee GenAI use has moved outside governance?
A: Look for personal email registrations, corporate accounts that are not tied to enterprise authentication, and shadow usage of public AI platforms on managed devices.
Q: What breaks when third-party access is not governed as part of identity lifecycle management?
A: Access can outlive the business relationship that justified it, which leaves external identities active after need has ended.
Practitioner guidance
- Define the third-party identity boundary Inventory vendor, partner, and platform accounts that can reach internal systems, then assign ownership, review cadence, and offboarding triggers to each one.
- Build exposure controls for edge devices Use segmentation, restriction of inbound paths, and tighter monitoring around internet-facing systems so a disclosed flaw does not become a full-environment entry point.
- Approve one sanctioned path for employee AI use Require managed identities and approved authentication for any GenAI service that may receive corporate data, and remove business reliance on personal email registrations.
Bottom line: Third-party involvement is no longer a peripheral issue, because external dependencies can now become the shortest route into internal environments.
Glossary terms: Third-party breach exposure, Blast Radius Control, Sanctioned AI, Edge Exposure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 hours ago by NHI Mgmt Group
11/07/2026 9:11 pm
Third-party breach exposure is now an identity governance problem, not just a supply chain concern. When 30% of breaches involve third parties, the old assumption that risk sits cleanly outside the enterprise no longer holds. The governance failure is not only vendor risk review, but the lack of continuous control over delegated trust, shared credentials, and cross-boundary access. Practitioners should treat partner identity as part of the identity estate, with lifecycle, scope, and revocation discipline.
A question worth separating out:
Q: Should organisations prioritise patching or containment for high-risk device fleets?
A: For patchable systems, patching remains necessary, but for fleets with long patch cycles or no patch path, containment should come first. The right priority depends on whether the device can be remediated in time. If not, reduce reachable services and enforce network-level least privilege.
👉 Read our full editorial: Verizon DBIR 2025 signals a reset in breach and identity risk