Why Third-Party Access Remains the Weak Link in Supply Chain Security

Attackers are increasingly exploiting trusted third-party components to compromise systems and spread malicious activity across connected targets, meaning your next breach may begin with someone you trust. The article notes that more than half of surveyed professionals (51%) keep access to partner systems after it is no longer needed, turning routine collaborations into hidden vulnerabilities that accumulate over time, a finding highlighted by the Thales Digital Trust Index report, Third-Party Edition.

It warns that weak authentication, slow onboarding, and delayed revocation leave identities vulnerable to phishing and create an expanding attack surface that adversaries are actively weaponising, with 40% of professionals across industries having to reset passwords once or twice a month. Verizon’s 2025 Data Breach Investigations Report is cited as showing 62% of system intrusion incidents involve the supply chain, underscoring the real-world consequences of these gaps.

The piece advocates a stronger IAM strategy that extends zero-trust principles to third parties, end-to-end lifecycle management, and continuous monitoring of access, roles, and attributes.