Topic starter
28/05/2026 11:38 am
TL;DR: Third-party compromise remains a practical route into enterprise environments, and Saviynt cites the Sisense breach as evidence that supplier access can cascade into identity and data risk. Governance has to extend beyond direct systems of record to the external services and credentials that can reach them.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Sisense Breach Highlights Rise in Major Supply Chain Attacks”.
Key questions
Q: What breaks when non-human identities are not governed like human accounts?
A: Service accounts, API keys, tokens, and AI agents can retain access long after the original task ends because they do not naturally pass through joiner-mover-leaver processes.
Q: Why do supply chain attacks so often turn into identity incidents?
A: Because attackers are not only changing code, they are harvesting the non-human identities that code runs beside.
Q: What are the warning signs that non-employee identity governance is failing?
A: Common signs include not knowing how many non-employee identities exist, finding duplicate or shared accounts, and seeing access that no longer matches sponsor ownership.
Practitioner guidance
- Map every third-party identity path Create an inventory of supplier accounts, service credentials, API keys, certificates, and delegated tokens that can reach your environments.
- Separate human and non-human third-party access Review external access with different criteria for people and machine identities, because service credentials often survive longer and reach deeper than contractor logins.
- Apply blast-radius limits to external integrations Restrict every vendor path to the minimum systems and data it needs, and segment high-value assets away from shared supplier access.
Bottom line: Supply chain compromise becomes an identity problem when vendors and integrators hold credentials that can reach core systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:42 am
Supply chain attacks are identity attacks once the supplier holds the keys: The control problem is no longer confined to the victim organisation’s perimeter. When a third party can authenticate into downstream systems, the customer inherits that party’s access design, revocation discipline, and privilege scope. Practitioners should treat supplier access as a governed identity domain, not a contractual footnote.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat supplier access as part of PAM or separate from it?
A: Supplier access should be governed as part of PAM when it can reach high-value systems or sensitive data. External accounts often need tighter scoping, stronger monitoring, and faster revocation than ordinary user access. If a third party can perform privileged actions, the controls protecting that access should be aligned with privileged access management, not left in a separate vendor file.
👉 Read our full editorial: Supply chain attacks are exposing the limits of identity controls