We keep a close watch on how ransomware groups pick their targets, because the entry point isn’t always obvious.
In August, a ransomware group listed a Tasmanian building firm on a dark web leak site, months after breaching a Tasmanian hospitality operator and publishing stolen passport scans and financial records (Insurance Business).
Insurance broker Gallagher ties cases like this to a wider pattern: small businesses are increasingly breached not through their own systems, but through third-party access, the logins and connections suppliers and partners hold into their environment. Verizon’s 2026 Data Breach Investigations Report puts third-party involvement in 48% of breaches globally, the highest share on record.
It’s exactly the risk we build into every client review: who has access, why, and whether it still needs to. None of it means locking vendors out, most fixes are structural and don’t need a big budget.
Here’s why third-party access has become such a common blind spot, the simple rules that close it, and how we help clients stay ahead of it.
How Is Third-Party Access Managed Safely?
Managing third-party access safely means giving every supplier or vendor login only the permissions their work requires, limiting how long that access stays open, requiring approval before it’s granted, keeping an audit trail of who accessed what and when, and reviewing access on a regular basis so it doesn’t linger.
Why Third-Party Access Is the Hidden Risk
Every business now depends on outside logins: your bookkeeper, your software vendor’s support team, the contractor who manages your phones. Each one is a door into your systems, and most businesses have no clear picture of how many doors are actually open.
- Vendor accounts rarely get reviewed. Once a supplier is set up with access, that login often stays active long after the project ends or the contract changes, simply because nobody was assigned to switch it off.
- One compromised partner can expose many clients. Attackers increasingly target the technology company in the middle, because breaching one managed service provider can open the door to every client on its books, a risk the Australian Signals Directorate’s guidance on managing cyber supply chains addresses directly.
- Remote access tools are a favourite target. The software that lets a vendor dial into your systems from anywhere is exactly what a criminal wants to hijack, and it’s often left running with no expiry date.
- Access sprawl builds up quietly. A handful of suppliers over a few years turns into dozens of logins, and by then nobody remembers who has access to what, let alone why.
The pattern is consistent. Businesses lock down their own staff logins carefully, then leave supplier and vendor access running in the background, unreviewed and effectively invisible until something goes wrong.
→ Insight: The OAIC’s latest Notifiable Data Breach statistics include a case study of a government agency breached through a subcontracted developer, and recommend regularly auditing vendor access rather than checking it only once, when a supplier is first brought on.
What Is Vendor Access Governance?
Vendor access governance is simply the set of rules that decide who gets into your systems, for how long, and who has to approve it first. It sounds formal, but in practice it’s a handful of straightforward habits.
- Access windows. Give a vendor access for the length of the job, not indefinitely, so a support ticket from six months ago doesn’t leave a login quietly open today.
- Approval before access, not after. A quick sign-off from someone on your side before a new supplier gets a login closes the biggest gap we see: access nobody remembers granting in the first place.
- Audit trails. Every vendor login should leave a record. If something does go wrong, knowing exactly who accessed what and when is the difference between a quick fix and weeks of guesswork.
- Least privilege as the default. A vendor supporting your accounting software doesn’t need access to your email system, and shouldn’t have it just because it was easier to set up that way at the time.
None of these rules need specialist tools or a big budget. They need someone responsible for asking the question before access is granted, rather than discovering the answer months later.
→ Bonus Resource: If login sprawl is part of the problem, our post on single sign-on for business covers how consolidating logins makes this kind of access far easier to see and control.
Third-Party Access Looks Different by Industry
The vendors with access to your systems change depending on what you do, but the risk follows the same shape everywhere from a construction site to an aged care facility.
- Construction. Site management software, plant and equipment trackers, and subcontractor logins often connect straight back to head office systems, an issue we’ve touched on in our piece on construction site connectivity.
- Aged care. Rostering platforms, clinical software vendors and allied health providers often need direct access to resident records, exactly the kind of access our aged care IT support strategies are built around.
- Health and professional services. Specialist software vendors and billing partners typically hold some of the most sensitive data in the business, from patient records to financial details.
One thread runs through all three: the number of outside logins quietly built into how the business runs day to day, usually more than anyone in the office would guess.
→ Insight: Health providers already report more data breach notifications than any other sector under Australia’s official scheme, according to Insurance Business’s reporting on a recent GP network breach, a reminder of how much rides on the access surrounding that kind of data.
How OneCloud Locks Down Third-Party Access for Clients
We treat vendor and supplier access as part of the same security setup as staff accounts, not an afterthought bolted on whenever a new supplier turns up.
- We set time-boxed access, not standing logins. Vendor accounts get switched on for the job and off again afterwards, rather than sitting active indefinitely.
- We build in an approval step. New vendor access goes through a quick check before it’s granted, so nothing gets added without someone deciding it should be there.
- We log and review vendor activity. Every login is recorded, and we periodically check who still has access against who should still have it.
- We separate vendor accounts from everything else. A supplier supporting one system doesn’t inherit access to your whole network just because it’s convenient at setup time.
In our experience, the clients who handle this well aren’t running anything exotic. They’ve simply made third-party access someone’s job to manage, rather than something that happens by default.
→ Pro Tip: Not sure how many active vendor logins exist across your business right now? Our cyber security services page outlines how we map and lock down exactly this kind of access.
Building Third-Party Access You Can Trust
Third-party access isn’t going away. Businesses will keep bringing on new software vendors, contractors and specialist partners, and each one will need some level of access to get their job done.
What changes is whether that access is time-boxed, approved and logged, or left running quietly in the background. Getting third-party access right is one of the simplest ways to close a gap most businesses don’t realise they have.
Want a clear picture of who has access to your systems right now? Get in touch for a third-party access review.
