Topic starter
12/06/2026 9:46 pm
Supply chain identity risk is now a third-party governance problem, not just a vendor security problem. The breach pattern shows that organisations are inheriting access paths they do not fully control but are still accountable for. When third-party access exists, the real question is whether the access lifecycle, scope, and revocation model are governed with the same discipline as internal identities. Practitioners should treat external trust as an identity programme issue, not an exception.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams reduce identity risk in cloud supply chain attacks?
A: Start by inventorying every developer and automation identity that can reach repositories, build systems, and cloud roles. Then remove unnecessary permissions, segment trust between environments, and monitor for unusual token use or role assumptions. The goal is to make stolen credentials less reusable across the delivery chain and to shrink the blast radius of any one compromise.
👉 Read our full editorial: Sisense breach shows how supply chain attacks expose identity risk
13/06/2026 12:04 am
Supply chain compromise is now an identity governance problem, not only a vendor risk problem. The Sisense breach reinforces a pattern NHIMG has seen repeatedly: trusted third-party access becomes the shortest path into environments that otherwise appear well defended. That means procurement assurance and security questionnaires are not enough on their own. Practitioners need to govern the identity paths suppliers use, because those paths are what attackers actually inherit.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when a supplier compromise exposes internal systems?
A: Accountability usually sits with the organisation that granted and failed to govern the access, even if the initial compromise occurred at the supplier. Legal, procurement, security, and identity teams all need a shared process for approving, reviewing, and revoking external access. If no owner can answer for the identity, the control failed before the incident did.
👉 Read our full editorial: Sisense breach shows how supply chain attacks expose identity risk