Third-party breaches keep making news, but most organizations are still treating vendor access like an afterthought. They focus on internal security controls while giving external partners significant access with minimal oversight.
Understanding PAM vs vendor-focused privileged access isn’t just about fancy acronyms. It’s about recognizing that when your vendors get hacked, you get hacked too. And right now, those vendor breaches are becoming more frequent and costly.
PAM Essentials: A Quick Refresher
Traditional Privileged Access Management focuses on controlling elevated access within your organization. Most PAM approaches center around managing privileged accounts, monitoring administrative sessions, and ensuring that high-level system access follows proper approval processes.
This PAM model works well for internal scenarios where you have environmental control. Your system administrators operate on managed devices, follow established procedures, and work within your security perimeter. You can enforce policies, deploy monitoring tools, and maintain visibility into administrative activities through your existing infrastructure.
These solutions are designed for predictable, ongoing relationships with internal users who are already integrated into your security ecosystem. They assume you control the user lifecycle, the devices being used, and the network environment where privileged activities occur.
But here’s where it gets interesting: vendors break all those assumptions.
VPAM: When Vendor Access Gets Complicated
VPAM, or Vendor Privileged Access Management, represents a specialized approach that addresses the unique challenges of third-party access. Your HVAC contractor doesn’t use your managed laptop, your software consultant isn’t on your domain, and your third-party support team operates under completely different security standards. Unlike your employees, vendors bring their own policies, compliance requirements, and operational procedures that may not align with your internal standards.
This creates the “vendor access gap”: the space between what traditional PAM handles well and what vendor access actually requires. Standard PAM assumes you control the environment and have ongoing relationships. With vendors, you control neither.
The goal isn’t to force vendors into your internal processes. It’s to give them secure remote access without creating operational headaches for both sides.
The Vendor Security Problem Gets Real
Let’s look at the numbers, because they tell an important story. 35.5% of all breaches in 2024 were third-party related (up 6.5% from the year before), and when these breaches happen, it takes an average of 194 days to detect them and another 64 days to contain the damage.
Healthcare faces particularly severe risks, with 41% of third-party breaches in 2024 targeting healthcare organizations. When hospital systems go down because of vendor compromises, patient care suffers directly.
The financial impact is significant. According to Gartner research, the cost of a third-party cyber breach is typically 40% higher than the cost to remediate an internal cybersecurity breach. The consequences extend beyond immediate cleanup costs too. You’re dealing with regulatory fines, customer churn, and reputation damage that can last for years.
Examples of Major Vendor Breaches
The best way to understand vendor access risks is to examine how real attacks unfold. These three incidents demonstrate different ways vendor relationships can become attack vectors, each with devastating consequences that rippled across entire industries.
Target 2013: When HVAC Access Becomes Payment Card Compromise
The Target breach began on November 15, 2013, when attackers used stolen network credentials from Fazio Mechanical Services, Target’s HVAC contractor based in Sharpsburg, Pennsylvania. Fazio had legitimate access to Target’s network for electronic billing, contract submission, and project management, but this business relationship became the entry point for one of retail’s most damaging breaches.
The attack highlights a fundamental problem with vendor access scope. While Fazio needed network connectivity for administrative purposes, the access wasn’t properly segmented from Target’s payment processing systems. Once inside Target’s network, attackers moved laterally until they found what they were looking for: access to point-of-sale systems processing customer transactions. The breach ultimately compromised 40 million credit and debit cards and personal information for 70 million customers.
What makes this breach particularly instructive is how it demonstrates the vendor access gap in action. Fazio operated on their own devices, from their own network, with access designed for facilities management rather than IT administration. The incident forced organizations to recognize that vendor access requires fundamentally different security approaches than employee access management.
SolarWinds 2020: Supply Chain Compromise at Global Scale
The SolarWinds attack began in September 2019 but wasn’t discovered until December 2020, making it one of the longest-running undetected breaches in history. Russian state-sponsored attackers, later identified as the SVR, compromised SolarWinds’ Orion software build environment and inserted malicious code into routine software updates that were then distributed to approximately 18,000 customers.
The sophistication of this supply chain attack was unprecedented. Rather than targeting individual organizations, the attackers compromised a trusted software vendor to gain access to government agencies, Fortune 500 companies, and critical infrastructure operators simultaneously. The attack affected major entities including the U.S. Departments of Treasury, Commerce, and Homeland Security, along with private companies like Microsoft and FireEye.
What made the SolarWinds compromise so effective was its abuse of legitimate software distribution channels. Organizations trusted SolarWinds as a vendor and routinely installed Orion updates as part of normal IT operations. Traditional security monitoring tools weren’t designed to detect compromised software from trusted vendors, which allowed the attack to persist undetected for over a year. The incident fundamentally changed how organizations think about software supply chain security and vendor trust relationships.
Kaseya 2021: Managed Service Providers Under Attack
The Kaseya ransomware attack on July 2, 2021, demonstrated how attackers could leverage managed service provider relationships to achieve massive scale. The REvil ransomware group exploited zero-day vulnerabilities in Kaseya’s VSA remote management software to compromise approximately 60 MSPs, which then spread ransomware to an estimated 1,500 downstream businesses.
The attack was particularly devastating because MSPs have privileged access to their clients’ systems by design. When Kaseya’s VSA platform was compromised, attackers could push ransomware through the same trusted channels that MSPs used for legitimate system management. The REvil group initially demanded $70 million for a universal decryption key, though Kaseya ultimately obtained the decryptor without paying the ransom.
The Kaseya incident highlighted how vendor relationships create cascading risk. Each compromised MSP served multiple client organizations, multiplying the attack’s impact exponentially. It also demonstrated how attackers increasingly target the vendors and service providers that have the most privileged access to the most organizations. The attack prompted CISA to issue specific guidance for MSPs and their customers about managing third-party risk in managed service relationships.
These incidents illustrate that vendor access compromises aren’t isolated events affecting single organizations. They’re systemic risks that can cascade across entire industries, supply chains, and critical infrastructure sectors. The traditional approach of treating vendor access like employee access simply doesn’t account for these realities.
How Modern Solutions Handle Vendor Access
Organizations are recognizing that vendor access needs a different approach than employee access management. Products that make VPAM a priority focus on several key capabilities:
- Just-in-time access: Vendors get temporary access for specific tasks and time periods, with automatic expiration when projects complete.
- Browser-based sessions: Secure connections eliminate VPN setup and client software installation while maintaining strong encryption.
- Session isolation: Each vendor session operates independently with clear boundaries around accessible systems and data.
- Complete audit trails: Every vendor action gets logged and optionally recorded for compliance and investigation purposes.
Admin By Request’s Secure Remote Access solution addresses vendor access through its Vendor Access component, which is one of three capabilities within the SRA platform. External users connect through https://access.work via single sign-on, accessing internal devices through secure WebSocket connections without requiring access to your main Admin By Request portal.
The underlying architecture uses Docker-based gateways (either cloud-hosted or self-hosted) with secure Cloudflare tunnels, eliminating the need for persistent VPN connections or exposing endpoints directly to the internet. All vendor activity is controlled according to your portal settings and fully logged, with optional session recording for compliance requirements.
This integrates with SRA’s other components: Unattended Access for IT administrators and Remote Support for user assistance. Rather than managing multiple point solutions, you get one platform that handles different remote access scenarios while maintaining consistent security standards and approval workflows.
The main advantage here is eliminating complexity while giving vendor access the specialized attention it needs. You get consistent approval workflows, monitoring, and compliance across all remote access types.
Making the Right Choice for Your Organization
When you’re evaluating vendor access solutions, focus on what actually matters for your situation:
- What types of vendors do you work with? Short-term contractors need different access patterns than long-term strategic partners
- What compliance requirements do you face? Some industries need detailed session recording or specific approval workflows
- How well will this work with your existing setup? Look for solutions that integrate with your current identity providers and monitoring tools
- Will your team and vendors find this easy to use? Complex systems create adoption problems and security workarounds
The best solutions eliminate friction for both sides. Vendors shouldn’t need to install software on devices you don’t control, and your IT team shouldn’t need to manage multiple disconnected tools. Browser-based access and integrated platforms tend to work better than complicated multi-vendor setups.
Think about your actual risk profile too. If you have lots of short-term contractors, you need different capabilities than organizations with a few long-term strategic partners. Don’t pay for enterprise features you’ll never use, but don’t skimp on the security controls that match your actual vendor relationships.
The ROI usually comes from three places: fewer support tickets, faster vendor onboarding, and avoiding the massive costs of vendor-related incidents. Focus on solutions that deliver those benefits without creating new operational headaches.
Your vendors are already accessing your systems. The question is whether you’re securing that access properly or just hoping nothing bad happens. If you would like to see our Secure Remote Access solution in action, book a demo or download our Lifetime Free Plan today.
