Notifications
Clear all
Topic starter
22/06/2026 10:00 am
TL;DR: Third-party access and exposed credentials can turn a supplier compromise into enterprise identity risk, with broader lessons for NHI governance, according to Saviynt. The issue is not just supply chain exposure, but the weak accountability model behind external identities and delegated access.
NHIMG editorial — based on content published by Saviynt covering the Sisense breach and the rise in major supply chain attacks
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when a supplier identity is compromised but still trusted downstream?
A: The main failure is that the downstream organisation inherits the supplier's access path without inheriting its security controls.
Q: Why do third-party credentials increase breach impact so quickly?
A: Third-party credentials often connect to production systems, automation workflows, or cloud services that were built for convenience rather than containment.
Q: How do security teams reduce supply chain identity risk in practice?
A: They reduce it by inventorying external identities, limiting what each one can reach, and tying access to a specific owner and business purpose.
Practitioner guidance
- Map every third-party identity to an owner Create a current inventory of supplier accounts, API keys, service principals, and delegated integrations, then assign a business owner who can approve or revoke access without delay.
- Shorten the life of shared credentials Replace long-lived secrets with tightly scoped, expiring credentials where possible, and record the systems each credential can reach so exposure does not cascade silently.
- Build supplier offboarding into access review Tie vendor contract changes, renewals, and terminations to mandatory access review and revocation steps for all connected identities and integrations.
What's in the full analysis
Saviynt's full article covers the source incident and related supply chain developments that this post intentionally leaves at the level of governance analysis.
- The original breach context and the supplier relationship details that shaped the incident path
- The article's own framing of why supply chain attacks are increasing across identity-dependent services
- Related news items and commentary that show how the vendor is positioning the topic across its newsroom
- Implementation-oriented context around identity security messaging that is not fully unpacked here
👉 Read Saviynt's coverage of the Sisense breach and supply chain attack trend →
Supply chain access and identity risk: what teams are missing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/06/2026 10:44 am
Third-party identity is now part of the attack surface: Supply chain compromise works because downstream organisations still treat supplier access as outside their core identity programme. That assumption fails when external credentials, tokens, and delegated integrations can reach production systems with minimal friction. The implication is that third-party identity governance has to be treated as a primary control domain, not a procurement afterthought.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: Who should be accountable for third-party identity exposure?
A: Accountability should sit with the internal owner of the relationship, not only with procurement or the supplier. IAM, security, and application teams need a shared revocation path so third-party access can be removed as soon as the business need ends. Without that ownership, risky credentials remain active by default.
👉 Read our full editorial: Sisense breach shows how supply chain access becomes identity risk
