Notifications
Clear all
Topic starter
28/08/2026 12:04 pm
TL;DR: Third-party credentials, SaaS tokens, and vendor accounts are often provisioned once and rarely re-evaluated, which lets attackers inherit broad reach and move quickly across environments, according to Zero Networks. Point-in-time onboarding controls are not enough when third-party access outlives the relationship that created it; continuous reachability governance is the real containment problem.
NHIMG editorial — based on content published by Zero Networks: Third-Party Access Governance: How to Prevent Supply Chain Attacks
By the numbers:
- Among CEOs of highly resilient organizations, 78% say third-party and supply chain vulnerabilities are their #1 barrier to becoming cyber resilient.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
A: Treat third-party access as a scoped trust problem, not a one-time onboarding step.
Q: Why do third-party identities increase supply chain risk?
A: Third-party identities increase risk because they depend on another organisation’s hygiene while still operating inside your trust boundary.
Q: What breaks when third-party access is not reviewed continuously?
A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed.
Practitioner guidance
- Inventory every third-party identity path Build a complete register of vendor accounts, contractor access, OAuth tokens, API keys, and integration credentials, then tie each one to an owner and business purpose.
- Constrain third-party reach by default Use microsegmentation and identity-based access controls to restrict each external identity to the smallest viable set of applications, ports, and data paths.
- Time-box privileged external access Apply just-in-time elevation for any third-party administrative pathway and require revocation immediately after the task is complete.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on microsegmentation for third-party access containment across internal applications and protocols.
- Practical examples of replacing VPN and RDP-style trust with identity-based secure remote access.
- Implementation detail for just-in-time MFA on privileged pathways used by vendors and contractors.
- The article’s discussion of real-time network visibility for dynamic access policy decisions.
👉 Read Zero Networks' analysis of third-party access governance and supply chain risk →
Third-party access governance: what is your team actually controlling?
Explore further
28/08/2026 12:04 pm
Third-party access governance is a reachability problem, not just an onboarding problem. Most organisations still treat the initial approval of a vendor, contractor, or integration as the main governance event. That assumption fails once the identity remains active while the business relationship, application scope, or internal topology changes. The implication is that governance has to track live exposure, not historical approval.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which shows how quickly governance expectations diverge from day-to-day practice.
A question worth separating out:
Q: Who is accountable when a vendor causes a cyber incident?
A: Accountability sits with both sides, but the buying organisation remains responsible for governing the access it granted. Security, IAM, procurement, and the business owner all need clear ownership for onboarding, monitoring, and revocation. If no one owns the full lifecycle, third-party risk becomes an inherited control gap.
👉 Read our full editorial: Third-party access governance is the missing control in supply chain risk
