Most small business security attention focuses on external attacks. A significant and underscrutinized portion of small business breaches involve someone who already had legitimate access. Third-party vendors, contractors, and service providers are the access vector that gets the least scrutiny and causes the most damage when it goes wrong.
Analysis Briefing
- Topic: Third-party vendor access controls and supply chain risk
- Analyst: Mike D (@MrComputerScience)
- Context: A back-and-forth with a reader that went deeper than expected
- Source: Pithy Cyborg
- Key Question: How does legitimate access become your biggest security liability?
How Third-Party Access Becomes an Attack Vector
Third-party access becomes a breach vector through three mechanisms. The vendor’s own systems are compromised and the attacker uses the vendor’s legitimate credentials to access your environment. The vendor’s employee leaves and their access is not revoked. The access granted to the vendor was broader than necessary and an attacker who compromises the vendor gets more than the vendor needed.
The SolarWinds breach is the most documented large-scale example: attackers compromised SolarWinds’ build environment and inserted malware into a software update that was then distributed to thousands of customers through the vendor’s trusted update mechanism. Those customers had no direct vulnerability. The same dynamic plays out at small business scale constantly, with bookkeepers, web developers, IT consultants, and marketing agencies as the access points.
The Zombie Access Problem
Zombie access is the term for credentials that remain active after the reason for their existence has ended. A web developer who built your site three years ago. A bookkeeper you stopped working with eighteen months ago. A former IT consultant whose admin credentials you never removed.
Most small businesses have zombie access they are unaware of. The people who granted it are sometimes no longer at the company. The systems it accesses have changed. The original access decisions are undocumented.
An attacker who compromises a former vendor does not announce themselves. They use the existing legitimate access quietly. The activity may not look unusual because it is associated with a credential that has a history of legitimate use.
The Principle of Least Privilege in Practice
The principle of least privilege holds that every user, system, and service should have access to exactly what they need and nothing more. For third-party vendors this means scoping access tightly to the specific systems, files, and functions required for the engagement.
A bookkeeper needs access to your accounting software. They do not need access to your cloud storage, your email platform, or your customer database. A web developer needs access to your website hosting. They do not need admin credentials to your entire cloud infrastructure.
Scoping access requires more initial setup than handing over admin credentials. It prevents a compromised vendor from being a master key to your entire environment.
When creating vendor credentials, use dedicated accounts in each system under the vendor’s name rather than sharing your own login, or use a password manager that supports credential sharing for specific vaults or entries. When the relationship ends, disabling the vendor account affects only their access and leaves yours intact.
The SaaS Sprawl Problem ➞ Inventory Before You Audit
Before you can audit third-party access, you need an accurate inventory of every SaaS tool your business uses. This list is almost always longer than people expect when they sit down to compile it.
Most small businesses have accumulated more SaaS tools than anyone tracks. The project management tool someone signed up for two years ago. The file sharing service used for one client engagement. The analytics platform a former employee integrated. The CRM trial that never got cancelled. Each of these tools may have vendor or contractor accounts associated with it that have never been reviewed. Each may have integrations connecting it to other tools, creating access paths that were never explicitly authorized.
Start with your payment records. Every SaaS subscription billed to a company card is a system that exists. Cross-reference against what your team actually uses. Decommission anything not actively needed. The tool you are not using still presents an attack surface through dormant credentials and stale integrations.
The output of this inventory step is a simple spreadsheet: tool name, who has access, what level of access, when it was last reviewed. That document becomes the foundation for every audit that follows.
| Risk Category | The 2026 Reality | The “Blast Radius” |
| Vendor Hubs | 70% of top vendors have at least one unpatched critical vulnerability. | An attacker hitting one “hub” can reach thousands of SMBs. |
| Master Key Leakage | 62% of major vendors have corporate credentials circulating in “stealer logs.” | Attackers log in as “legitimate” admins; no “hacking” required. |
| The “Silent Window” | Vendors take an average of 117 days to disclose a breach. | You could be compromised for 4 months before you are even notified. |
| The Human Cost | 47% of ex-employees retain access to at least one corporate SaaS app. | Your biggest risk might be the contractor you “fired” last year. |
The Quarterly Access Audit
With an accurate inventory in hand, a quarterly access audit becomes manageable. Review every account with access to your systems. Verify that the person or organization still has a current relationship with you. Verify that the level of access is still appropriate. Remove anything that fails either check.
The first audit will take longer than subsequent ones because there is no baseline to compare against. Set aside a half day for the initial pass. Once the inventory spreadsheet exists and is current, subsequent quarterly reviews typically take one to two hours. Update the spreadsheet as you go: vendor name, systems accessed, access level, last verified date, relationship status. The goal is a living document you maintain rather than a discovery exercise you repeat from scratch each quarter.
This is among the highest-value security activities a small business can perform because it directly addresses access accumulation before it becomes a breach.
What This Means For You
- Start with a SaaS inventory before the audit. Pull your payment records and list every tool your business pays for. The list will be longer than you expect. Decommission anything not actively in use.
- Build the access spreadsheet during your first audit: vendor name, systems accessed, access level, last verified date, relationship status. Every audit after that is an update, not a discovery.
- Create dedicated credentials for every vendor rather than sharing your own. Use a named account in each system or a password manager with credential sharing. When the relationship ends, disable the vendor credential without touching yours.
- Scope vendor access to minimum necessary. A contractor who needs access to one folder should not have admin access to the entire drive.
- Remove access immediately when vendor relationships end. Do not wait for the next audit cycle.
If this was useful, more like it lives at Pithy Cyborg | AI News Simple.