Vendor access to operational systems is now a board-level inventory item

Somewhere in your estate there is a maintenance contractor who still has the credentials they were given for a commissioning job in 2024. The job finished; the access did not. Nobody is watching the session.

A survey reported by Industrial Cyber on 8 October 2026 gives that scene a prevalence figure. Claroty’s global study of 2,000 business and technology leaders across 16 industries found that 58% experienced a cyberattack affecting operational environments in the past 12 months. Operational downtime was the most common impact, at 43%, followed by safety incidents at 40%. The number that should hold a security leader’s attention, though, appears later: three-quarters of respondents said an incident had affected operations and involved third-party access, while just under half conceded that they monitored third-party connections only partly or not at all.

The headline invites a familiar response — more OT detection, more segmentation, another tool. Those may be needed eventually. But the more useful reading for a mid-market organisation is narrower: remote access into operational environments is being run as a vendor management afterthought, and the survey has just given that afterthought a cost.

Only 16% of respondents said IT and operational security were fully integrated. At mid-market scale, that split is the whole problem. The person who knows which supplier holds a VPN into the building management system is often a facilities or engineering lead, not a security function. Approvals happen over email or phone, if they happen at all. Access is reviewed when something breaks. When a customer questionnaire asks which third parties can reach production systems, the answer is assembled from memory and the last invoice run. That is exactly the 49% finding, written into a single organisation.

Make third-party access an inventory, not an assumption

Governed infrastructure has three properties that ad hoc vendor access does not: someone owns it, someone can list it, and someone reviews it on a schedule. For remote access into operational systems, governance often starts with an inventory compiled by hand. If the only way to list your vendor connections is to ask three different people and wait a week, that is the finding.

For each connection, the questions are simple. Who supplied the account? Which device or system can it reach? Who owns the relationship inside the business? What is the least privilege required? Does the session get logged, recorded, or at least timed? When does the access expire? The last question is the most revealing. Standing access that survives a completed commissioning job is the default in operational environments.

A virtual CISO engagement can turn this from a periodic panic into a maintained register and a review cadence that leadership sees. That matters when there is no internal security leader, because ownership then tends to sit nowhere. With no named owner, expired supplier access simply persists until someone notices it during an incident.

The review cadence is the control

Claroty reports an average of three operational incidents per organisation linked to third-party access. That suggests the issue is a steady leak: too many standing connections, too little visibility, and a review process that starts after something has already happened.

A quarterly review changes this. Tie it to contract end dates, not to the calendar as an abstraction. When a maintenance agreement lapses, the access should lapse with it. When an engineer leaves a supplier, the shared account should not remain. The review should be short enough to appear in a board pack as a single line: how many vendor connections exist, how many are active, how many have an owner, and how many were removed this quarter.

This is also where cyber insurance underwriting now points. The survey links unmonitored third-party access directly to the controls insurers examine. You do not need a regulatory citation to justify the work; the renewal questionnaire will ask the question anyway. If the answer is that monitoring is partial, that answer is now measurable and increasingly expensive to carry.

Where an organisation stands can be checked with a scored self-assessment before any board conversation, but the register is the artefact that changes the discussion. A board will respond differently to a spreadsheet of live vendor connections, with expiry dates and owners, than to a general statement that third-party risk is being managed.

The vendors who support your production line will not volunteer an access review their own engineer is on the next job. If nobody inside owns the list, the list is written by whoever is still logged in.