Topic starter
25/06/2026 12:15 am
TL;DR: Zero trust programmes still leave a major opening when vendor and contractor access is not governed consistently, with only 36% of health IT leaders saying privileged access is applied enterprise-wide according to Imprivata and Ponemon Institute. The gap shows that continuous verification is incomplete without lifecycle control over third-party identities and access paths.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Zero Trust Efforts Fall Short When Vendor Access Is Ignored”.
By the numbers:
- Only 36% of health IT leaders say their organisations have a privileged access strategy applied consistently enterprise-wide.
Key questions
Q: What breaks when vendor access sits outside zero trust governance?
A: Zero trust breaks at the boundary where third-party identities are treated as exceptions.
Q: Why do third-party breaches keep happening even when MFA is in place?
A: MFA reduces some password-based attacks, but it does not stop token theft, session hijacking, or misuse of an already trusted vendor relationship.
Q: How should security teams govern vendor access in a zero trust programme?
A: They should treat vendor access as part of the core identity model, not as a separate remote support exception.
Practitioner guidance
- Standardise third-party access governance Bring vendors and contractors into the same approval, entitlement, review, and offboarding process used for internal privileged users so access is not managed through a separate exception path.
- Eliminate standing vendor privilege Replace persistent third-party access with task-scoped access windows and remove privileges as soon as the operational need ends.
- Require strong identity verification for remote access Use MFA and real-time identity checks for all external access paths, especially where vendors previously entered through VPN-based or broad network routes.
Bottom line: Vendor access is a zero trust governance problem when third-party identities are handled through separate approval and review paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:07 am
Vendor access is where zero trust programmes most often break at the governance boundary. The article shows a familiar pattern: organisations adopt continuous verification in principle, but then leave third-party access on a different operating model. That is not a tooling gap alone. It is a governance exception that weakens the identity perimeter and makes the programme less credible to auditors, security operations, and business owners. The practitioner conclusion is that zero trust must be measured by third-party coverage, not internal-user coverage alone.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When does remote access become too broad for zero trust?
A: Remote access becomes too broad when it exposes a network path instead of a task path. If a vendor can pivot from one connection into multiple internal resources, the control is still network-centric rather than identity-centric. The safer model is application-level access with continuous re-checks of entitlement.
👉 Read our full editorial: Vendor access gaps are undermining zero trust identity controls