What breaks when vendor access is not tightly controlled in critical infrastructure?

Why This Matters for Security Teams

In critical infrastructure, vendor access is not a convenience layer. It is often a direct operational pathway into systems that affect uptime, safety, and recovery. When that access is overly broad or not time-bound, a routine support session can become an entry point for lateral movement, misconfiguration, or delayed incident containment. The risk is not just compromise. It is loss of traceability, especially when teams cannot prove who changed what, when, or why.

That is why NHI governance for third parties sits at the center of resilience planning, not only IAM hygiene. NHIMG research in the Ultimate Guide to NHIs shows how often non-human access is over-privileged and poorly rotated, while the OWASP Non-Human Identity Top 10 frames excessive standing access and weak lifecycle controls as recurring failure modes. One relevant signal from the 2026 Infrastructure Identity Survey is that 67% of organisations still rely heavily on static credentials despite the risks they pose to autonomous and third-party workloads.

In practice, many security teams only discover the blast radius of vendor access after an outage, a forensic review, or a regulator asks for a complete change history.

How It Works in Practice

Vendor access breaks down when it is treated as a permanent entitlement instead of a tightly scoped, accountable exception. The practical control model is straightforward: issue access only for an approved maintenance task, limit it to the exact system and time window required, record the session, and revoke it automatically when the task ends. That reduces both the attack surface and the ambiguity that makes incident reconstruction difficult.

Current guidance from NHI governance and zero-trust practitioners increasingly favors short-lived access and workload-style identity over shared accounts or long-lived credentials. The Ultimate Guide to NHIs — Key Challenges and Risks highlights how secrets exposure and excessive privileges create durable risk, while the CISA cyber threat advisories reinforce the need for containment, logging, and rapid credential invalidation when trusted access is abused. For critical infrastructure teams, the operational pattern is usually:

• Use per-ticket approval tied to a named vendor technician and asset.
• Grant JIT access with the shortest feasible TTL, then revoke automatically.
• Require MFA, session recording, and command-level logging for privileged work.
• Prefer brokered access through PAM or a bastion rather than direct network reachability.
• Separate diagnostic access from change authority so troubleshooting does not become administration.

Where this works best, the vendor can still do the job but cannot quietly persist after the job is finished. These controls tend to break down when maintenance is urgent, shared admin credentials are still embedded in legacy OT environments, or multiple vendors need overlapping access to the same fragile control plane because revocation and attribution become operationally contested.

Common Variations and Edge Cases

Tighter vendor control often increases coordination overhead, requiring organisations to balance resilience gains against maintenance speed and plant availability. That tradeoff is real, especially in OT, where patch windows are narrow and some equipment cannot support modern federation or session brokering.

Best practice is evolving, but there is no universal standard for every industrial environment yet. In some sites, shared jump hosts with full recording are the only realistic option. In others, a hardened PAM layer can enforce approval, least privilege, and traceable elevation. The key is to avoid confusing continuity with permanence: an access path can remain operational without remaining always-on.

Two common edge cases deserve attention. First, emergency vendor access during safety events needs pre-approved break-glass procedures, but those procedures still require time limits and post-event review. Second, remote support for vendors that administer multiple customers creates a supply-chain trust problem, because one weak technician account can cut across many sites. NHIMG’s 52 NHI Breaches Analysis and the Schneider Electric credentials breach illustrate how quickly credential exposure and third-party reach can turn into broad operational impact.

For critical infrastructure, the right question is not whether vendors need access. It is whether that access can be proven, constrained, and removed before it becomes a resilience event.

Related resources from NHI Mgmt Group

• What breaks when vendor remote access in OT is not tightly controlled?
• What breaks when access across trust domains is not tightly scoped?
• What breaks when break-glass access is not tightly governed?
• What breaks when session monitoring is missing from industrial remote access?