Topic starter
28/05/2026 11:38 am
TL;DR: Supply chain attacks increasingly turn trusted third parties into access paths, and Saviynt points to the Sisense breach as an example of how delegated trust can spread through identity and integration layers. The governance gap is no longer perimeter defense, but control over who and what can act through third-party access.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Sisense Breach Highlights Rise in Major Supply Chain Attacks”.
Key questions
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.
Q: Why do vendor credentials create such a large supply chain risk?
A: Because they often grant authenticated access that bypasses normal perimeter checks and can persist across many connected services.
Q: What are the signs that third party identity management is breaking down?
A: Common warning signs include orphaned accounts, access that is never revoked, no succession process when managers change, and no central view of vendor, supplier, or contractor risk.
Practitioner guidance
- Inventory every third-party identity path Build a single register of vendor accounts, service accounts, API keys, and support integrations that can reach production or sensitive data.
- Bind access to contract and task boundaries Require explicit expiry conditions for partner access so permissions end when the relationship, ticket, or deployment window ends.
- Recertify external entitlements separately from employee access Run distinct reviews for third-party users and non-human identities because their lifecycle, ownership, and offboarding triggers differ from human accounts.
Bottom line: Supply chain attacks increasingly exploit trusted third-party identities rather than only public-facing targets.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:42 am
Identity governance has become a supply chain control surface. Major supply chain attacks now succeed when organisations treat third-party access as procurement risk instead of active identity risk. The Sisense example shows that delegated trust can become the most direct route into enterprise systems. Practitioners should therefore treat partner access as part of the identity security programme, not as a separate vendor-management exercise.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when a supply chain identity path is compromised?
A: Organisations should contain the compromise by revoking the affected third-party identity, inventorying adjacent integrations, and verifying whether the same access pattern exists elsewhere. The response should also include recertifying partner entitlements and checking whether machine credentials or support channels outlived the original relationship. The goal is to stop delegated trust from remaining silently active.
👉 Read our full editorial: Major supply chain attacks show why identity governance must expand