How do organisations know if third-party monitoring is actually working?

Why This Matters for Security Teams

Third-party monitoring only matters when it changes decisions before exposure turns into compromise. That means watching for identity changes, permission drift, new subcontractors, and unexpected access paths, not just waiting for a monthly posture score. In NHI programmes, the risk is usually not that monitoring is absent, but that it is too slow, too shallow, or too disconnected from revocation and approval workflows. OWASP’s OWASP Non-Human Identity Top 10 reflects the same problem: visibility without action is not control.

NHIMG research shows why this matters operationally. In the Ultimate Guide to NHIs — Key Challenges and Risks, 92% of organisations expose NHIs to third parties, which makes supplier monitoring part of core identity defence rather than a vendor-management side task. If the monitoring programme cannot surface a new OAuth grant, a service-account permission expansion, or a subcontractor change early enough to trigger a response, it is measuring compliance noise rather than exposure.

In practice, many security teams discover that their third-party monitoring only worked after access had already broadened and the incident review had begun.

How It Works in Practice

Effective monitoring is event-driven, not report-driven. It should ingest identity telemetry from vendors and connected workloads, compare it against known baselines, and alert on changes that alter trust. That includes new accounts, scope expansion, token creation, stale secrets that remain live, and unusual access from new regions, devices, or automation paths. The question is not whether a supplier is “secure” in the abstract, but whether the monitoring stack can detect when its identities stop behaving as expected.

A useful control model is to combine continuous evidence collection with decision hooks. For example, if a partner creates a new API key, the system should correlate that event with the service it belongs to, the data it can reach, and whether approval still exists. If a subcontractor appears in the access chain, that should trigger reassessment of trust and possibly step-up review. NHIMG’s NHI Lifecycle Management Guide is helpful here because lifecycle visibility, rotation, and offboarding are the same operational problem from different angles. The 52 NHI Breaches Report also shows how often compromise follows unmanaged identity change rather than a dramatic perimeter break.

• Define which identity changes are material: role changes, scope growth, key issuance, vendor re-brokering, and dormant-account reactivation.
• Require evidence streams, not screenshots: logs, entitlement deltas, token events, and revocation records.
• Set response thresholds in advance: alert, suspend, re-approve, or force rotation.
• Test whether alerts arrive before the next access decision, not after the incident summary.

These controls tend to break down when vendors aggregate many customers into a shared platform and cannot expose identity-level telemetry with enough precision.

Common Variations and Edge Cases

Tighter third-party monitoring often increases operational overhead, requiring organisations to balance visibility against vendor friction and false positives. Best practice is evolving, and there is no universal standard for how much telemetry a supplier must provide to prove coverage. Some environments can validate monitoring through direct API integration, while others must rely on attestations, sampled evidence, or contractual clauses because the supplier architecture will not support deeper inspection.

One common edge case is indirect access through subcontractors or managed service providers. Monitoring can look effective at the primary vendor layer while missing the actual party changing secrets or permissions downstream. Another is “healthy” dashboards that still miss short-lived abuse because they only sample periodically. The current guidance suggests that short retention windows, revocation signals, and change-detection are more meaningful than broad confidence scores. OWASP’s guidance and NHIMG’s coverage of supply-chain exposure in the Shai Hulud npm malware campaign and Reviewdog GitHub Action supply chain attack both reinforce the same lesson: supplier trust can collapse through identity pathways long before a breach is obvious.

For this reason, organisations should judge third-party monitoring by whether it consistently surfaces actionable identity drift, not by whether it produces a reassuring risk score.

Related resources from NHI Mgmt Group

• How do organisations know whether AI identity monitoring is actually working?
• How do organisations know if AI governance is actually working?
• How do organisations know if continuous compliance is actually working?
• How do organisations know whether enterprise GRC architecture is actually working?