Topic starter
14/05/2026 6:12 pm
TL;DR: Third-party and supply chain incidents continue to expose identity data, access paths, and connected systems, with Saviynt’s roundup pointing to recurring failures in delegated trust, exposed credentials, and weak control over external dependencies. The security issue is not isolated compromise but unmanaged identity reach across partner ecosystems.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Sisense Breach Highlights Rise in Major Supply Chain Attacks”.
Key questions
Q: What breaks when non-human identities are not offboarded properly?
A: Orphaned NHIs remain valid long after the workload or integration they served is gone, which gives attackers a durable access path.
Q: Why do third-party credentials create more breach risk than perimeter controls alone can stop?
A: Third-party credentials can bypass perimeter defenses because they may be accepted as legitimate even when the initial compromise happened elsewhere.
Q: How can IAM teams tell whether vendor access is too broad?
A: Vendor access is too broad when the identity can reach systems or data outside the task it was hired to perform, especially if the permissions are permanent or reused across multiple services.
Practitioner guidance
- Map every third-party identity path Build an inventory of partner-linked service accounts, API keys, OAuth grants, and federated sessions that can reach production systems.
- Shorten external trust windows Replace open-ended partner access with time-bound scopes, explicit reapproval triggers, and routine revalidation of business need.
- Test offboarding before the contract ends Simulate partner removal for one external identity set and confirm that tokens, keys, and session paths are actually revoked across all connected systems.
Bottom line: Third-party breach exposure is fundamentally an identity governance issue because external access can outlive the business need that created it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/05/2026 6:13 pm
Third-party breach risk is an identity governance problem before it is a vendor risk problem. Most organisations still treat partner exposure as a procurement or security questionnaire issue, but the real control failure is identity reach without continuous lifecycle control. Once an external identity can act inside production, the organisation has accepted shared trust without shared governance. Practitioners should treat partner access as a governed identity class, not a one-time exception.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should security teams do after a supplier breach exposes customer data?
A: They should verify exposure, map which records or business units may be affected, notify impacted parties through a controlled process, and offer practical support such as monitoring or fraud protection where appropriate. Teams should also preserve evidence, coordinate legal and privacy review, and publish a timeline that explains what happened and what is being done next.
👉 Read our full editorial: Third-party supply chain breaches expose identity governance gaps