Topic starter
25/06/2026 2:54 pm
TL;DR: Third-party remote access is now a material breach path, with 47% of organisations reporting a vendor-network incident in the past year and 64% expecting these breaches to stay flat or rise, according to Imprivata’s cited analyst findings. Vendor access governance is failing where visibility, ownership, and least privilege are weakest, not where tooling is absent.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Russell fields five: Answers to five key questions on managing third-party vendor access risks”.
By the numbers:
- 47% of organisations experienced a breach involving vendor network access in the past year.
- 64% expect these breaches to increase or remain constant over the next year.
- 50% of organisations say they lack oversight and governance for third-party access.
Key questions
Q: What breaks when third-party access is not included in identity governance?
A: Auditability breaks first, followed by containment.
Q: Why do vendor accounts create higher breach risk than internal user accounts?
A: Vendor accounts often combine external connectivity, broad permissions, and weaker lifecycle oversight, which makes them attractive to attackers and hard to govern.
Q: What are the signs that third-party application monitoring is failing?
A: Signs of failure include unexpected data access from vendor-connected accounts, permission creep, unusual transaction patterns, and gaps between what a vendor can reach and what the business believes it exposed.
Practitioner guidance
- Define a third-party identity inventory Map every vendor, contractor and supplier account to a named owner, a business purpose and an expiry condition so access can be reviewed and revoked on a known schedule.
- Scope vendor privilege to task and time Limit each external identity to the minimum systems and actions needed for the job, then bind access to a specific task window rather than leaving it broadly persistent.
- Require named sessions for external users Eliminate shared vendor accounts wherever possible and preserve audit trails that show who accessed what, when and for what approved purpose.
Bottom line: Third-party access becomes a breach path when external identities are granted broader reach than their task requires and are not governed through the same lifecycle controls as internal users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:07 pm
Third-party access is a privileged governance problem, not a vendor management sidebar. Once external users can touch internal systems, their access needs the same ownership, review and revocation discipline as any other privileged identity. The article shows that many organisations still separate vendor access from core IAM and PAM processes, which creates a governance blind spot. The implication is straightforward: if third-party access is not treated as a first-class identity class, it will continue to behave like one of the easiest ways in.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern third-party access in regulated environments?
A: They should review third-party access as a separate governance stream with its own owners, expiry rules, and evidence trail. Third-party entitlements often outlive the business need that created them, which makes them harder to defend in audit and harder to contain when the relationship changes.
👉 Read our full editorial: Third-party access is exposing weak spots in privileged governance