Topic starter
25/06/2026 3:03 pm
TL;DR: A ransomware attack on a major aerospace company disrupted airline check-in operations across Europe, and Imprivata reports that 47% of organisations suffered a third-party breach in the past year, with more than a third tied to excessive privileged access. The pattern shows why vendor identity governance now affects operational continuity, not just security hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Major Aerospace Cyberattack Underscores Need for Increased Third-Party Security”.
By the numbers:
- 47% of organisations reported a third-party breach in the past year.
- 58% of organisations lack a consistent vendor access plan.
Key questions
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.
Q: Why do vendors with excessive privileged access increase outage risk?
A: Excessive privilege gives an attacker or compromised supplier account more system reach than the business task requires.
Q: How do security teams know whether vendor access is actually governed?
A: They should be able to answer three questions without delay: who has access, what they can reach, and how quickly access can be removed everywhere it exists.
Practitioner guidance
- Define vendor access by service impact Inventory every third-party identity and tie it to the business service it can affect, including check-in, booking, support, and administrative workflows.
- Eliminate excess vendor privilege Review supplier roles for overbroad permissions, especially credentials that can reach production systems or cross multiple business functions.
- Track vendor sessions continuously Monitor active third-party sessions for unusual duration, cross-system movement, and access outside the agreed task window.
Bottom line: The aviation incident shows that third-party access can interrupt core operations when vendor credentials sit directly on the service path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
25/06/2026 4:21 pm
Third-party identity governance has become an operational resilience control, not a procurement detail. The aviation case shows that vendor access can affect passenger movement, manual handling capacity, and service continuity at the same time. Once an external identity sits on the operational path, access governance becomes part of resilience engineering, not a back-office review step.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations rely on manual fallback when third-party systems fail?
A: Manual fallback is useful as a continuity bridge, but it is not a substitute for governed third-party access. If the organisation depends on manual processes for more than a short interruption, the underlying access model is too brittle. Teams should treat fallback testing as evidence about resilience, not as proof of control.
👉 Read our full editorial: Third-party access controls failed aviation resilience in a ransomware event
This post was modified 3 days ago by NHI Mgmt Group