Topic starter
09/06/2026 11:06 pm
TL;DR: Supply chain attacks are increasingly using compromised non-human identities and delegated access to move through trusted relationships, with major incidents like the Sisense breach underscoring how third-party exposure can widen blast radius according to Saviynt. The lesson is that identity governance must extend beyond direct employees to vendors, service accounts, and machine credentials before trust becomes an attack path.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Sisense Breach Highlights Rise in Major Supply Chain Attacks”.
Key questions
Q: What breaks when third-party access is not lifecycle managed?
A: Access outlives accountability.
Q: Why do vendor credentials create such a large supply chain risk?
A: Because they often grant authenticated access that bypasses normal perimeter checks and can persist across many connected services.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Map every third-party identity path Inventory vendor accounts, API keys, service accounts and delegated tokens that can reach production systems, then record the business owner and offboarding trigger for each one.
- Reduce standing partner privilege Replace broad vendor roles with task-scoped access, and require time-bound approvals for support and integration access that crosses trust boundaries.
- Tie credential lifecycle to contract lifecycle Revocation should happen when the relationship changes, not when someone notices misuse, so vendor access must be retired as part of procurement and offboarding.
Bottom line: Supply chain breaches increasingly succeed by abusing trusted third-party identity paths rather than by attacking the primary target head-on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
This topic was modified 2 days ago 2 times by NHI Mgmt Group
10/06/2026 1:19 am
Third-party identity is now part of the attack surface, not a separate trust domain. The Sisense breach sits inside a wider pattern where supplier access, integration credentials, and machine identities are treated as operational conveniences rather than governed identities. That boundary no longer holds when attackers target the trust relationship itself. Practitioners should treat every external connection as a governed identity path, not a procurement footnote.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Our research also found that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: How should organisations respond when a supplier has already been compromised?
A: Contain the identity path before focusing only on the breach narrative. Revoke exposed credentials, rotate shared secrets, disable dormant integrations, and inspect downstream systems that accepted the supplier's access. The immediate goal is to cut off reused trust, because the attacker usually wins by staying inside the delegated relationship.
👉 Read our full editorial: Sisense breach shows why supply chain identity risk keeps growing
11/06/2026 12:25 am
Third-party identity is now part of the attack surface, not a separate trust domain. The Sisense breach sits inside a wider pattern where supplier access, integration credentials, and machine identities are treated as operational conveniences rather than governed identities. That boundary no longer holds when attackers target the trust relationship itself. Practitioners should treat every external connection as a governed identity path, not a procurement footnote.
A few things that frame the scale:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Our research also found that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: How should organisations respond when a supplier has already been compromised?
A: Contain the identity path before focusing only on the breach narrative. Revoke exposed credentials, rotate shared secrets, disable dormant integrations, and inspect downstream systems that accepted the supplier's access. The immediate goal is to cut off reused trust, because the attacker usually wins by staying inside the delegated relationship.
👉 Read our full editorial: Sisense breach shows why supply chain identity risk keeps growing
12/06/2026 1:57 am
Supply chain identity risk is becoming a lifecycle problem, not a point-in-time breach problem. The Sisense example fits a broader pattern in which third-party access survives longer than the business assumption that justified it. When access is granted for integration, support or delivery, it is rarely re-evaluated with the same discipline at offboarding or contract change. The practitioner conclusion is that supplier access must be governed as an identity lifecycle, not as a static connection.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should organisations do when a vendor relationship changes?
A: They should revoke or narrow the vendor’s access as part of the relationship change itself, not as a separate cleanup task. Offboarding, service substitution, and integration retirement all need a deliberate access removal step or old privileges will outlive the business need.
👉 Read our full editorial: Sisense breach shows why supply chain identity risk keeps growing
This post was modified 4 days ago by NHI Mgmt Group