Topic starter
25/06/2026 5:10 pm
TL;DR: Sisense’s breach underscores how supply chain attacks increasingly ride on third-party access paths and identity trust, with Saviynt linking the incident to broader exposure across partner and customer ecosystems. The real problem is not just compromise, but governance built on assumptions that third-party access remains bounded and reviewable.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Sisense Breach Highlights Rise in Major Supply Chain Attacks”.
Key questions
Q: What breaks when third-party access is not offboarded cleanly?
A: The organisation loses control of who can still reach sensitive systems after the business need has changed.
Q: Why do third-party identities increase supply chain risk?
A: Third-party identities increase risk because they depend on another organisation’s hygiene while still operating inside your trust boundary.
Q: How do security teams know if supplier access governance is failing?
A: A governance failure shows up when you cannot answer three questions quickly: who has access, what data they can reach, and when that access expires.
Practitioner guidance
- Map every third-party identity path Inventory partner, supplier, and integrator accounts, then tie each one to a named business owner, allowed purpose, and revocation trigger.
- Shorten external access lifetimes Replace open-ended third-party entitlements with time-bounded access that expires unless the business case is renewed.
- Re-certify supplier access on relationship change Trigger access review and offboarding when contracts end, scopes change, or vendors move roles, rather than waiting for the next periodic review.
Bottom line: The breach pattern shows how supply chain attacks often succeed through trusted third-party identity paths rather than direct compromise of the target.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
This topic was modified 3 days ago by NHI Mgmt Group
This topic was modified 2 days ago by NHI Mgmt Group
25/06/2026 5:42 pm
Supply chain identity risk is now a lifecycle problem, not a perimeter problem. Once third-party access is treated as a standing relationship rather than a governed identity, the control model breaks down. That means ownership, review, and revocation must follow the relationship itself, not just the account name. Practitioners should treat supplier access as a managed identity estate.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between vendor risk management and identity governance?
A: Vendor risk management asks whether a supplier is acceptable overall. Identity governance asks what that supplier can access, for how long, and under what conditions. In a breach, the second question determines blast radius. That is why supplier controls must be measured as access controls, not only as contractual or compliance obligations.
👉 Read our full editorial: Sisense breach highlights the rise of supply chain identity risk
This post was modified 4 days ago by NHI Mgmt Group