Topic starter
25/06/2026 10:44 pm
TL;DR: 47% of organisations experienced a third-party breach in the past year, according to Imprivata data, while 34% of those incidents were tied to vendors with excessive privileged access, underscoring how downstream access paths now drive breach exposure. Visibility, centralised inventory, and tighter identity controls matter because supply chain trust breaks where accountability stops.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Third- and Fourth-Party Blind Spots Escalate as Vendor Access Gaps Undermine Cyber Resilience”.
By the numbers:
- 47% of organisations experienced a third-party breach in the past year.
- 34% of those incidents were due to vendors having too much privileged access.
- Organisations now manage access for an average of 20 vendors.
Key questions
Q: What breaks when vendor access is not inventoried in manufacturing environments?
A: When vendor access is not inventoried, least privilege, review, and revocation controls all lose their reference point.
Q: Why do over-privileged vendor accounts increase breach risk in critical industries?
A: Over-privileged vendor accounts expand the number of systems an outsider can touch and make revocation harder to govern.
Q: How should security teams govern third-party access in identity programs?
A: Treat third-party access as a managed identity relationship with an owner, scope, expiry, and revocation process.
Practitioner guidance
- Build a centralised vendor identity inventory Record every direct vendor, subcontractor, managed tool, and service account with network or data access, then tie each one to an owner and contract relationship.
- Replace broad vendor VPN access Move suppliers to named-user authentication, least privilege entitlements, and time-bound credentials so access matches a defined task rather than a standing connection.
- Extend recertification to fourth-party paths Review not only the primary vendor account but also downstream access inherited through that vendor, including subcontractors and unmanaged tools.
Bottom line: Third- and fourth-party access gaps widen breach exposure when governance stops at the direct supplier boundary.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:25 pm
Third- and fourth-party access risk is now an identity governance problem, not only a procurement problem. The article shows that direct supplier vetting does not close the real exposure if downstream accounts, subcontractors, and tools remain outside the identity inventory. The control failure is not a lack of concern, but a mismatch between contract boundaries and access boundaries. Practitioners should govern who can reach systems, not just who signed the agreement.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between vendor risk management and vendor access governance?
A: Vendor risk management evaluates the third party's overall security, compliance, and operational profile. Vendor access governance controls what that party can actually do in your environment, for how long, and under what conditions. Both matter, but access governance is the part that prevents residual credentials from becoming a live security problem.
👉 Read our full editorial: Third- and fourth-party blind spots are weakening vendor risk controls