Notifications
Clear all
Topic starter
25/06/2026 12:15 am
TL;DR: Zero Trust programmes can still leave a major gap when vendor and contractor access is not governed consistently, with only 36% of health IT leaders saying privileged access strategy is applied enterprise-wide, according to Imprivata and the Ponemon Institute. The control model is incomplete until third-party identities are brought into the same verification, least-privilege, and review discipline as internal users.
NHIMG editorial — based on content published by Imprivata: Zero Trust Efforts Fall Short When Vendor Access Is Ignored
By the numbers:
- Only 36% of health IT leaders say their organizations have a privileged access strategy applied consistently enterprise-wide.
Questions worth separating out
Q: How should security teams govern vendor access in a zero trust environment?
A: Security teams should treat vendor access as part of the core zero trust policy, not as a separate exception process.
Q: Why does vendor access weaken zero trust programmes in practice?
A: Vendor access weakens Zero Trust when it is managed through separate onboarding paths, broader privileges, or lighter review than internal access.
Q: What do organisations get wrong about privileged access for third parties?
A: Organisations often assume privileged access controls only need to cover employees or permanent administrators.
Practitioner guidance
- Map every third-party access path Inventory vendor, contractor, and support access routes into production systems, including remote access tools, shared admin channels, and emergency exceptions.
- Extend PAM controls to external identities Apply vaulting, just-in-time elevation, session recording, and approval workflows to vendor access instead of reserving them for employees.
- Replace broad remote access with granular verification Retire VPN-style access where possible and use tools that enforce real-time identity verification, task-scoped entitlements, and tighter session boundaries.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- Practical deployment steps for MFA, credential vaults, and least-privileged access in vendor workflows
- How to replace VPN-based access with remote access tools that enforce real-time identity verification
- The article's discussion of PAM and VPAM for improving compliance and operational efficiency
- The source's framing of Zero Trust as an adaptive security mindset for human and third-party identities
👉 Read Imprivata's analysis of why vendor access gaps weaken Zero Trust →
Vendor access in zero trust: what IAM teams are missing?
Explore further
25/06/2026 9:07 am
Vendor access is the missing trust boundary in many Zero Trust programmes. The architecture is often designed around internal users, while third-party identities are handled through exceptions, shared support pathways, or separate tooling. That leaves a structural gap between policy intent and operational enforcement. Practitioners should treat external access as part of the core trust model, not as an edge case.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- 45% of organisations cite lack of credential rotation as the top cause of NHI-related attacks, according to the same research.
A question worth separating out:
Q: How do you know if zero trust is actually covering vendor access?
A: You know Zero Trust is covering vendor access when third-party identities follow the same approval, session recording, and entitlement review process as internal privileged users. If vendors still use separate support channels or standing access exceptions, the programme is only partially enforced.
👉 Read our full editorial: Zero trust fails when vendor access stays outside governance
