Topic starter
25/06/2026 3:13 pm
TL;DR: Manufacturers face expanding third-party access risk as attackers exploit shared vendor credentials, weak oversight, and broad permissions, with 47% of organisations reporting a vendor-driven attack in the past year according to Imprivata and Ponemon Institute. The core issue is that traditional PAM assumes internal trust boundaries that vendor access does not have.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Mitigating vendor access risks: Cybersecurity essentials for manufacturers”.
By the numbers:
- 29% of breaches involved trusted third parties, according to a 2024 SecurityScorecard report cited by Imprivata.
- Nearly half of organisations, 47%, suffered an attack via a vendor in the past year, according to Imprivata and the Ponemon Institute cited by Imprivata.
Key questions
Q: What breaks when vendors use shared privileged access in manufacturing environments?
A: Shared vendor access breaks accountability, because the organisation can no longer tie a command, configuration change, or data action to one person.
Q: Why do third-party vendor breaches create outsized risk for manufacturing operations?
A: Third-party breaches are risky because manufacturers often depend on vendors for just-in-time parts, shared data, and critical services.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay.
Practitioner guidance
- Inventory every vendor identity and access path Build a complete list of vendors, their subcontractors, and every system or VPN domain they can reach.
- Replace shared vendor credentials with unique identities Require individually attributable accounts for external users so session activity can be traced to a person rather than a team-shared credential.
- Constrain vendor access to task-specific scope Apply role-based and time-bound permissions so a vendor can only reach the minimum systems needed for the support task.
Bottom line: Third-party access becomes a manufacturing risk when shared credentials, broad permissions, and weak oversight let vendors act outside a tightly controlled support task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:36 pm
Vendor access without lifecycle offboarding is the central governance failure here: external access that was acceptable at onboarding often remains in place long after the business need has changed. The article describes exactly that drift when it notes that third-party accounts are often granted blanket access years ago and not consistently reviewed. The implication is not simply more review, but a different lifecycle model for external identities.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 74% of organizations report identity-related breaches, and privileged access is a leading cause of lateral movement.
A question worth separating out:
Q: What is the difference between internal PAM and vendor privileged access management?
A: Internal PAM assumes the user and device are within a managed trust boundary, while vendor privileged access management has to govern external identities, vendor turnover, and subcontractor risk. The difference is not just user type. It is whether the control model can verify ownership, scope, and accountability outside the organisation.
👉 Read our full editorial: Vendor privileged access management for manufacturing risk