Topic starter
11/06/2026 11:02 pm
TL;DR: Third-party suppliers were tied to nearly 30% of data breaches in 2025, according to JumpCloud citing Verizon, as organisations expand dependency on external applications and services; treating vendor risk as procurement rather than a security control leaves customers, data, and operations exposed. Third-party governance now has to cover patching, assessment, and ongoing oversight, not just onboarding.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “Managing the Modern Threat: Why Third-Party Application Vulnerabilities Matter”.
By the numbers:
- Nearly 30% of data breaches in 2025 were tied to third-party suppliers, according to JumpCloud citing Verizon.
Key questions
Q: How should security teams govern vendor access across the third-party lifecycle?
A: Security teams should govern vendor access as a lifecycle, not a one-time approval.
Q: Why do supplier breaches often become IAM problems inside the customer environment?
A: Because the customer usually inherits the access relationship even when it does not control the supplier’s security posture.
Q: What breaks when third-party patching is not centrally visible?
A: When patching is not centrally visible, security teams lose the ability to tell which external applications are exposed to known vulnerabilities.
Practitioner guidance
- Map third-party dependencies to security-critical services Identify which suppliers, SaaS platforms, and externally managed applications can affect data, identity, or operational continuity.
- Tie onboarding to continuous vendor assurance Move beyond pre-purchase checks and establish recurring review of vendor security posture, patch practices, and service changes.
- Inventory and patch third-party applications centrally Maintain a current view of installed third-party Mac and Windows applications, version state, and update policy enforcement.
Bottom line: Third-party vendor exposure is a governance problem because external services can become breach paths into customer data and business operations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 7:31 am
Third-party risk is now an identity governance problem, not just a supplier management problem. Once external applications participate in business operations, they become part of the trust model that IAM and security teams are accountable for. The practical implication is that vendor oversight, access control, and operational assurance must be governed together.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise vendor due diligence or ongoing monitoring?
A: They need both, but ongoing monitoring usually matters more after onboarding because risk changes over time. Due diligence screens the initial decision, while monitoring checks whether the vendor still meets the organisation’s trust threshold. If a programme stops at procurement, it misses patch drift, service changes, and new exposure paths.
👉 Read our full editorial: Third-party vendor risk is now a core cybersecurity control gap
This post was modified 4 days ago by NHI Mgmt Group