Topic starter
25/06/2026 2:54 pm
TL;DR: Manufacturers are managing access for an average of 20 vendors, yet only half maintain a comprehensive inventory, while 59% do not monitor third-party access at all, according to Imprivata. That combination turns vendor access into a supply chain control problem, not just a security hygiene issue.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Manufacturers Face Rising Supply Chain Risk from Unmonitored Vendor Access”.
By the numbers:
- 59% don’t monitor third-party access at all.
Key questions
Q: What breaks when vendor access is not inventoried in manufacturing environments?
A: When vendor access is not inventoried, least privilege, review, and revocation controls all lose their reference point.
Q: Why does vendor access increase supply chain risk in plant environments?
A: Because vendor credentials often reach sensitive production, support, or engineering systems that are connected to operational workflows.
Q: What are the signs that third-party access controls are failing in practice?
A: Common warning signs include broad or stale tokens, undocumented permission changes, open endpoints, inconsistent documentation, and vendor activity that blends into routine system traffic.
Practitioner guidance
- Establish a complete vendor identity inventory Catalogue every third-party account, support identity, and privileged pathway tied to manufacturing operations, then assign business ownership and offboarding responsibility.
- Enforce least privilege on contractor access Limit each vendor to the specific plant, application, or support function it needs, and remove broad standing access from shared or legacy environments.
- Monitor third-party sessions continuously Track who accessed what, when, and why for every vendor session, especially where privileged access tools are used in OT-adjacent environments.
Bottom line: Unmonitored vendor access in manufacturing is a governance failure because third-party identities can outlive the business need that created them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:08 pm
Vendor access has become a supply chain identity problem, not a narrow security hygiene issue. Imprivata's data shows the problem is not just the number of vendors, but the lack of inventory, monitoring, and trust in the tools supposed to govern that access. In manufacturing, where operational continuity depends on third parties, ungoverned access becomes a structural exposure across production and support ecosystems.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should manufacturers control third-party access without slowing operations?
A: Use temporary, task-scoped access with explicit expiry, strong approval workflows, and detailed logging. Give vendors only the systems and sessions they need for the current job, then revoke access automatically when the task ends. That reduces exposure while preserving the collaboration manufacturing depends on.
👉 Read our full editorial: Unmonitored vendor access is widening manufacturing supply chain risk