The main mistake is treating a point-in-time assessment as if it were continuous assurance. Vendor security posture changes as systems, integrations, and controls change, so a report can quickly become stale. Organisations also overestimate the value of certification alone and underweight live monitoring, contract requirements, and evidence that the provider can maintain controls over time.
Why third-party security reports go stale so quickly
Third-party reports are snapshots, not live assurance. They capture a provider’s controls at a moment in time, but integrations, permissions, cloud settings, personnel, and code paths can change the next day. The real failure is assuming that a clean report means the provider remains well controlled until renewal, when the actual risk surface is continuously moving.
That mistake matters because vendor risk is usually created by change, not by the report itself. A provider can pass an assessment while still having weak offboarding, stale tokens, or newly exposed integrations that were not present during the review window. A report is useful evidence, but it is not a substitute for ongoing control ownership and continuous monitoring.
Third-party access problems often start after onboarding, especially where SaaS-to-SaaS integrations or OAuth grants remain active long after the original business need has changed. That is why a report should be read as one input to an access and assurance program, not as a statement that the relationship is safe by default. For a concrete example of how integration risk can persist after an apparently legitimate connection, see Salesloft OAuth token breach.
What organisations overestimate about certification and vendor assurance
Many buyers overvalue certification because it is easy to compare and easy to file away. A certificate or report can show that a provider once met a control baseline, but it does not automatically prove current separation of duties, active monitoring, timely revocation, or whether the provider’s own third parties are equally controlled.
The deeper error is treating assurance as a document rather than a set of behaviours. If contract terms do not require timely notice of material changes, evidence of control operation, or rights to review relevant logs and attestations, the buyer may have no practical way to tell whether the provider’s posture has degraded. In that sense, the report can create false confidence while the underlying accountability remains weak.
Organisations also miss the difference between a provider’s broad assurance statement and the specific control that protects their environment. A good report may say the vendor has security processes, but the buyer still needs to understand whether token rotation, scope minimisation, and access reviews are actually enforced for the integration in question. That is especially important where the service depends on third-party SaaS connectors, as in SaaS-to-SaaS and OAuth App Governance Guide.
What continuous assurance should include instead
Strong third-party assurance is built around evidence that changes over time. Organisations should expect contractually backed monitoring, periodic revalidation, clear offboarding triggers, and proof that controls such as access review, secret rotation, and incident notification are actually operating. The point is to verify control persistence, not just control existence.
Practically, that means distinguishing between what the report can tell you and what only live oversight can tell you. A report can help establish baseline trust, but it cannot tell you whether a provider has just changed an integration, introduced a new dependency, or retained dormant access paths that are no longer needed. Where third-party credentials or tokens are involved, continuous governance matters more than annual paperwork, as shown in cases such as the Klue OAuth Supply Chain Breach and the GitHub Repo Breach, Heroku and Travis CI OAuth Tokens.
If the business impact is material, buyers should ask for evidence of how the provider detects control drift, not merely how it documented its controls during the assessment. That includes revocation capability, logging, notification timelines, and the ability to prove that access has been removed when an integration is retired or compromised. For a broader view of how overprivilege and stale access create lasting exposure, see IAM and IGA Basics.
Risk and Threat Considerations
When organisations rely on third-party reports as if they were ongoing assurance, the main risk is blind trust in a control environment that may already have changed. The provider can lose posture through configuration drift, access sprawl, or compromised integrations, while the buyer continues to assume the earlier report still reflects reality.
Failure mechanism: Point-in-time evidence masks post-report change, so expired review cycles, unrevoked tokens, and unmonitored vendor access can persist until an incident exposes them.
Impact: That creates a larger blast radius for data exposure, unauthorized access, and delayed detection, especially when the vendor sits inside a critical business workflow or has broad SaaS integration privileges.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-53 Rev 5 sets the technical controls, and SOC 2 (AICPA) and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Third-party integrations and vendors can introduce stale or compromised access paths. |
| NHI-07 — Long-Lived Secrets | Reports often miss secrets or tokens that remain valid long after review. | |
| NHI-05 — Overprivileged NHI | Vendor assurance can hide excessive access that outlives the original need. | |
| Recommendation — Review vendor integrations for third-party NHI exposure and revoke risky grants quickly. Enforce rotation and expiry for vendor secrets, tokens, and API keys. Reduce vendor grants to least privilege and recertify them on a schedule. | ||
| NIST SP 800-53 Rev 5 | SA-9 — External System Services | Third-party reports are part of governing external services and provider responsibilities. |
| CA-7 — Continuous Monitoring | The question is about why point-in-time reports fail without ongoing assurance. | |
| IA-5 — Authenticator Management | Vendor tokens and secrets can outlive the assessment that approved them. | |
| Recommendation — Define provider security obligations, monitoring, and audit rights in the service contract. Continuously monitor provider controls and integration risk after onboarding. Rotate, expire, and revoke vendor authenticators and shared secrets promptly. | ||
| SOC 2 (AICPA) | CC4.1 — Monitoring Activities | SOC 2 reports are a common third-party assurance input, but need ongoing monitoring. |
| Recommendation — Pair vendor reports with ongoing monitoring evidence and change alerts. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Supplier assurance and oversight are central to third-party report reliance. |
| A.5.20 — Addressing information security within supplier agreements | Contracts must require notice, evidence, and control maintenance over time. | |
| Recommendation — Set security requirements and review responsibilities for suppliers and their changes. Write security reporting, notification, and verification duties into supplier agreements. | ||
Practitioner Guidance
What to verify: Ask whether the vendor can prove access revocation, logging, and control operation after the report date, not just during the audit window. If the answer is only a report or certificate, treat the assurance as incomplete.
Decision rule: If the provider can reach sensitive systems, production data, or high-value integrations, require continuous evidence, contract notification duties, and a defined offboarding process before accepting the relationship as low risk.
What practitioners underestimate: The most common failure is not a bad report, but a good report that is allowed to age into irrelevance while the integration footprint keeps changing.
Practitioner takeaway: Third-party security reports should establish a starting point for trust, not the endpoint; if you cannot observe change, you cannot assume control.
Related resources from NHI Mgmt Group
- What do healthcare security teams get wrong when they rely on manual processes for temporary staff and third-party access?
- What do organisations get wrong about AI compliance when they rely on third-party vendors?
- What do organisations get wrong when they rely on one-off security testing?
- What do organisations get wrong when they rely on training completion as a security metric?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
