Topic starter
08/07/2026 6:54 pm
TL;DR: Third-party privileged access programs still fail when VPN access, shared accounts, weak MFA, and poor logging are used instead of scoped, auditable controls, according to Leostream. The real issue is not whether vendors can connect, but whether identity, session, and offboarding governance can contain the access they receive.
Editorial analysis by NHI Mgmt Group, based on content published by Leostream: “Leostream Provides New Azure Marketplace”.
Key questions
Q: What breaks when third-party privileged access relies on VPN and shared accounts?
A: VPN access and shared accounts break third-party privileged access because they expand trust before authorization is tightly scoped and they erase individual accountability.
Q: Why do vendor access and privileged accounts increase hidden risk?
A: Vendor access and privileged accounts increase hidden risk because they often remain active after the original task ends.
Q: What are the signs that third-party access controls are failing in practice?
A: Common warning signs include broad or stale tokens, undocumented permission changes, open endpoints, inconsistent documentation, and vendor activity that blends into routine system traffic.
Practitioner guidance
- Enforce need-to-know vendor access Grant third parties only the applications, data sets, and administrative functions required for the approved task, not general network reach.
- Remove shared vendor credentials Assign unique identities to each contractor or service provider so authentication and logging preserve individual accountability across sessions.
- Add session recording to privileged work Capture vendor actions during high-risk remote sessions so reviewers can reconstruct what changed, what data was touched, and who did it.
Bottom line: Third-party privileged access becomes dangerous when organisations let VPN reach, shared credentials, and weak attribution substitute for scoped identity controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:16 pm
Third-party privileged access is an identity governance problem, not just a remote-access problem. The article is right to separate VPN connectivity from controlled privilege. External access becomes risky when organisations treat it as a transport issue instead of a lifecycle issue covering approval, attribution, session oversight, and offboarding. Practitioners should govern vendor access as a bounded identity state, not a convenience feature.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern vendor access after a contract ends?
A: They should treat contract end as an access revocation trigger, not an administrative afterthought. That means closing VPN routes, disabling any remaining accounts, verifying that shared credentials were not reused elsewhere, and checking logs for post-engagement activity. Fast offboarding matters because lingering third-party access outlives the business need and weakens accountability.
👉 Read our full editorial: Third-party privileged access still depends on identity controls