Notifications
Clear all
Topic starter
30/07/2026 9:41 am
TL;DR: Third-party access to corporate networks expands the attack surface through broad VPN access, shared accounts, long-lived credentials, and weak visibility, according to Securden and cited source material. Least privilege, JIT access, phishing-resistant MFA, secure brokering, and automated offboarding are now baseline controls, not optional hardening.
NHIMG editorial — based on content published by Securden: Best Practices for Third-Party Access to Corporate Networks
By the numbers:
- 80% faster deployment for vendor access management is cited for the unified platform approach described in the article.
- 60% lower total cost of ownership is cited for the same consolidated third-party access model.
Questions worth separating out
Q: How should security teams govern third-party identity access?
A: Security teams should inventory every external identity path, assign an internal owner, and apply scope, expiry, and revocation rules to each connection.
Q: Why do vendor accounts create higher breach risk than internal user accounts?
A: Vendor accounts often combine external connectivity, broad permissions, and weaker lifecycle oversight, which makes them attractive to attackers and hard to govern.
Q: What do organisations get wrong about third-party offboarding?
A: They often treat offboarding as a manual cleanup step instead of a control objective.
Practitioner guidance
- Enforce task-bound vendor entitlements Map each third-party role to a minimal permission set, then expire that access automatically when the contract, project, or support window closes.
- Replace broad VPN access with brokered paths Route vendor sessions through controlled access paths that expose only the required application or system, not the internal network as a whole.
- Require phishing-resistant MFA for privileged vendors Use keys, certificates, or other strong factors for elevated third-party accounts, and reserve OTP-style methods for lower-risk access only.
What's in the full article
Securden's full article covers the operational detail this post intentionally leaves for the source:
- A fuller breakdown of its unified vendor access, PAM, IAM, and CIEM control model for third-party identities.
- Step-by-step examples for JIT access, secure brokering, and automatic deprovisioning in vendor workflows.
- More implementation detail on phishing-resistant MFA, session monitoring, and access inventory management.
- Practical guidance on tying vendor offboarding to procurement and contract lifecycle events.
👉 Read Securden's analysis of third-party access governance and vendor identity controls →
Third-party access governance: are your vendor controls keeping up?
Explore further
30/07/2026 10:53 pm
Third-party access is an NHI lifecycle problem before it is a perimeter problem. External users, contractors, and partners are non-human identities in practice because their access is mediated through accounts, secrets, sessions, and entitlement grants. The article correctly centres lifecycle controls such as onboarding, time-bound access, monitoring, and offboarding. The practitioner lesson is that governance must follow the access object across its full lifespan, not just the login event.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 60% of NHIs are being overused, with the same NHI utilised by more than one application, according to The 2025 State of NHIs and Secrets in Cybersecurity.
A question worth separating out:
Q: Who is accountable when a vendor account is misused?
A: Accountability should sit with the business owner of the access, the system owner, and the security team that approved the entitlement. If the relationship is governed well, the vendor can be identified, the session can be reconstructed, and the approval path can be reviewed against policy.
👉 Read our full editorial: Third-party access governance needs tighter identity controls
