Topic starter
06/06/2026 11:15 am
TL;DR: Third-party access remains a common breach path because many organisations still rely on shared accounts, weak MFA, broad vendor permissions, and inconsistent offboarding, according to Imprivata’s analysis of Change Healthcare, Target, and current access patterns. The core problem is not just access sprawl but governance that assumes vendor identities are stable, observable, and easy to re-certify.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “The state of third-party access security: Are we gaining ground or spinning wheels?”.
Key questions
Q: What breaks when third-party access uses shared credentials?
A: Shared credentials break attribution, make monitoring less useful, and complicate incident response because logs cannot reliably map actions to a person.
Q: Why do third-party breaches keep happening even when MFA is in place?
A: MFA reduces some password-based attacks, but it does not stop token theft, session hijacking, or misuse of an already trusted vendor relationship.
Q: How do security teams know whether vendor access is actually governed?
A: They should be able to answer three questions without delay: who has access, what they can reach, and how quickly access can be removed everywhere it exists.
Practitioner guidance
- Maintain a live third-party access inventory Track every vendor, the systems they touch, the business reason for access, and the internal owner who approves and reviews it.
- Replace shared vendor logins with named identities Give each external user a unique account tied to a real person and remove generic or team-wide credentials from privileged workflows.
- Enforce phishing-resistant MFA plus session checks Use stronger authentication together with device posture, location, and session-risk signals so a normal login does not automatically equal trusted access.
Bottom line: Third-party access fails most often at the identity layer, where shared accounts, weak authentication, and broad permissions turn legitimate vendor work into a breach path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:56 am
Third-party access is still governed as if vendor identities were stable employees, and that assumption is now the core failure. Vendor access is temporary, distributed, and operationally pressured, but many organisations still manage it through static approvals and broad permissions. That mismatch explains why shared accounts, weak MFA, and delayed offboarding keep recurring. The practitioner conclusion is clear: third-party access must be governed as a lifecycle, not a one-time grant.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between just-in-time access and zero standing privilege?
A: Just-in-time access is the delivery pattern, while zero standing privilege is the policy goal. JIT grants access when needed and removes it after use. ZSP goes further by eliminating persistent access as the default state. Teams need both, but ZSP is the governance model that makes JIT meaningful.
👉 Read our full editorial: Third-party access management still fails on basic identity controls