You can give suppliers, freelancers and machine vendors secure access without creating a single VPN account: broker their sessions through the browser, scoped to exactly one application, with nothing to install on their device. That shift matters more every year — third-party involvement in breaches doubled to 30% in the Verizon 2025 DBIR — and under the Belgian NIS2 law, your suppliers’ access hygiene is now legally your problem.
Key takeaways
- Third parties were involved in 30% of confirmed breaches in the 2025 DBIR, double the previous year, and 48% of security professionals call third-party remote access their weakest attack surface.
- The classic pattern fails structurally: VPN accounts grant network-level access with no session visibility, and 54% of organisations don’t even have a complete inventory of which externals hold active credentials.
- NIS2 Article 21 makes supplier access a legal duty: supply-chain risk management (21(2)(d)), access-control policies (21(2)(i)) and MFA on all remote access (21(2)(j)), operationalised in CyFun controls like PR.AC-4.
- Agentless, browser-based access renders RDP, SSH and web apps inside a standard browser session — no client install, no network path, full session audit — which is why it fits contractors, BYOD and OT vendors alike.
- A three-tier model (view-only → single app → time-boxed JIT) plus disciplined offboarding replaces the “everyone gets a VPN account” default in 60 to 90 days.
How big is the third-party access problem?
The Verizon 2025 DBIR — 22,052 incidents, 12,195 confirmed breaches — put third-party involvement at 30%, exactly double the ~15% of the year before. Exploitation of edge devices and VPN appliances rose 34% year-over-year, and ransomware appeared in 88% of breaches at small and mid-sized organisations. Survey data adds the governance picture: 47% of organisations suffered a third-party-caused breach in the past year (Imprivata/Ponemon, February 2025), teams spend an average of 134 hours per week managing vendor access, and in earlier SecureLink/Ponemon studies 70–74% of victims traced the breach to excessive privileged access granted to externals. The cost anchor: IBM puts the average supply-chain breach at $4.91 million.
| Statistic | Value | Source |
|---|---|---|
| Breaches involving third parties | 30% (doubled YoY) | Verizon DBIR 2025 |
| Third-party access linked to breaches | 35.5%; 41.4% of ransomware | SecurityScorecard 2025 |
| Orgs breached via third-party access (12 mo) | 47% | Imprivata/Ponemon 2025 |
| No complete inventory of externals with access | 54% | SecureLink/Ponemon |
| Breaches blamed on over-privileged vendor access | 70–74% | SecureLink/Ponemon 2021–2022 |
| Average supply-chain breach cost | $4.91 million | IBM 2025 |
The incidents that wrote the rulebook
Target, 2013: attackers phished credentials from an HVAC contractor and walked from facility systems to payment networks — 40 million cards, 70 million customer records. Kaseya, July 2021: one compromised RMM platform pushed REvil ransomware to over 1,500 downstream organisations at once. Colonial Pipeline, 2021: a legacy VPN account without MFA shut down fuel distribution for the US East Coast. Oldsmar, 2021: an unauthorised TeamViewer session tried to change chemical levels at a water plant. MOVEit, 2023: one file-transfer product exposed 2,773 organisations and 95 million records. And on 25 March 2026, CERT-EU confirmed a supply-chain compromise that exfiltrated 91.7 GB across 29 EU entities from the European Commission’s cloud infrastructure. Different decades, same lesson: the external party’s access path is your attack surface.
Why the standard fixes keep failing
- VPN accounts grant networks, not applications. A contractor’s device gets an internal IP and can scan, discover and move laterally. The tunnel encrypts the traffic and hides the behaviour: no application-level visibility, no session recording.
- Accounts outlive contracts. With 54% of organisations lacking a vendor-access inventory and 63% lacking permission visibility, ex-contractor Active Directory accounts stay live for months — the DBIR’s median time to remediate leaked secrets is 94 days.
- RMM tools evade your defences. CISA’s joint advisory on remote access software (June 2023) documents how legitimate, signed tools like AnyDesk and TeamViewer blend into baselines, run as portable executables without admin rights, and get abused for persistence — the exact pattern behind Oldsmar and countless MSP incidents.
- OT makes it worse. Machine builders connect to PLCs and HMIs running Windows 7/XP-era systems that cannot take an EDR or ZTNA agent, and OEMs void warranties when third-party software lands on their controllers. Agent-based security is a non-starter there, as covered in securing the devices you cannot patch.
What NIS2 and CyFun actually require
The Belgian NIS2 law of 26 April 2024 (in force since 18 October 2024) turns supplier access into a compliance object. Article 21(2)(d) requires managing supply-chain security risks, including the access practices of your direct suppliers; Article 21(2)(i) requires access-control policies covering externals; Article 21(2)(j) mandates MFA on remote access. The CCB’s CyberFundamentals framework operationalises this: PR.AC-4 (least privilege — externals restricted to exactly the asset their contract requires), PR.AC-1/2 (unique identities, MFA, structured revocation) and ID.AM-1/2 (a real inventory of external connections). ISO 27001:2022 mirrors it in A.5.19–A.5.20 and A.8.2, and IEC 62443-3-3 (SR 1.13) applies the same discipline to OT vendor access. The full supplier mandate is unpacked in the NIS2 supply-chain guide — the short version: “the vendor had a VPN account” is now a finding, not a practice.
The options, compared honestly
| Approach | What externals must install | Access granularity | Session visibility | OT/BYOD fit | Indicative published pricing |
|---|---|---|---|---|---|
| Legacy VPN account | VPN client | Network subnet | Low (network logs only) | Poor | Often bundled with firewall |
| ZTNA with agent | Software agent (often refused on vendor laptops) | Per application | Moderate | Low — agents don’t install on PLC/vendor gear | ~$120/user/year benchmark (as of 2026) |
| Agentless / clientless ZTNA | Nothing — standard browser | Per application (RDP/SSH/web in-browser) | High, in-browser auditing | Optimal | ~$6–$12/user/month market range (as of 2026) |
| Vendor-PAM (e.g. Wallix, CyberArk) | None (proxy portal) | Per credential/session | Very high (video recording) | High | Enterprise custom licensing |
| VDI for externals | Client or HTML5 | Full desktop | Moderate | Moderate | ~$15–$30/user/month plus compute |
The pattern to notice: everything that works well for externals converges on the browser. Sessions brokered at Layer 7 mean the contractor’s device never gets a network path — malware on their laptop has no route to cross, because only rendered pixels and keystrokes traverse the connection. That is the same isolation principle behind web application isolation, and it is why agentless access also solves the BYOD problem: the device’s trust level stops mattering when the device never touches the network.
The three-tier model that replaces VPN accounts
- Tier 1 — view-only isolation. Auditors and documentation contractors get web apps rendered read-only in the browser: downloads, uploads and clipboard disabled. Nothing to install, nothing to take away.
- Tier 2 — single-application proxy. Software contractors and SaaS maintainers get exactly one target — a web portal, an SSH host, an RDP session — through the clientless gateway with MFA at the front door. No network routing exists to abuse.
- Tier 3 — segmented just-in-time access. Machine builders and sysadmins get time-boxed sessions (hard stop after the work window), enabled only after the internal system owner approves the request, with session recording and no raw credentials exposed — access is off by default and returns to off automatically.
Rollout follows four phases aligned with CISA and NCSC guidance: discover every external account and VPN profile (the inventory 54% of organisations lack); stand up the agentless gateway with IdP-backed MFA; move vendors tier by tier with JIT workflows; then revoke the external VPN profiles and standing AD privileges. A mid-market organisation typically completes the cycle in 60 to 90 days, running old and new side by side until the logs show the VPN accounts have gone dark.
Give them one app, not your network
Every statistic in this article traces to the same design flaw: external access was modelled as network membership. Reverse the model — least privilege by architecture, browser as the delivery surface, access that expires by default — and the breach vector, the audit findings and the offboarding chaos shrink together. This is where Jimber is deliberately strong for EU mid-market teams: its agentless web application isolation gives a supplier exactly one application in an ordinary browser, with MFA, session control and EU-hosted infrastructure, while the same platform covers your own workforce’s ZTNA — one console instead of a PAM-plus-VPN-plus-VDI patchwork, at a flat, predictable cost. Explore the VPN alternative use case or book a demo and bring your ugliest vendor-access example; that is usually the one that convinces the auditor too.
Frequently asked questions
Why is a VPN account for a contractor considered high risk?
Because a VPN operates at the network layer: the contractor’s device receives an internal IP with reach across the subnet, enabling scanning and lateral movement, while the tunnel provides no application-level visibility into what the user actually does. Compromised or malicious vendor devices inherit all of it.
How does agentless ZTNA work without installing software?
The external user authenticates through a web portal (with MFA via your identity provider); the gateway then renders RDP, SSH or web applications inside the browser using standard HTML5. No network transport exists between their device and your systems — only the rendered session crosses.
How does that stop malware on a contractor’s laptop from spreading to us?
Sessions are encapsulated at the application layer, so no packets route from the endpoint into your network. Network-propagating malware on the vendor device has no path to cross; the threat stays contained on their side of the browser.
What does the Belgian NIS2 law require for vendor access?
Article 21(2)(d) requires managing supply-chain security risk, 21(2)(i) requires access-control policies covering externals, and 21(2)(j) mandates MFA on remote access. CyFun translates this into controls like PR.AC-4 (least privilege) and ID.AM-1/2 (inventory of external connections) that auditors check.
What is just-in-time access and why use it for vendors?
JIT keeps vendor access disabled by default. It is enabled for a specific, approved work window — ideally tied to a ticket — and revokes automatically when the window closes, eliminating the standing privileges that caused 70–74% of third-party breaches in Ponemon’s studies.
What session evidence do auditors expect for third-party access?
Session recording or indexed activity logs, JIT requests linked to tickets, hard time-boxing, documented approval workflows and credential protection (vaulted or credential-less). ISO 27001 A.5.19/A.8.2, CyFun and IEC 62443 SR 1.13 all point at the same evidence set.
Why can’t we just install our security agent on the machine vendor’s laptop?
Vendors routinely refuse corporate agents on their own hardware, and OT-side equipment often runs legacy systems that cannot take an agent at all — with OEMs voiding warranties if third-party software is installed on controllers. Agentless browser-based access sidesteps the entire argument.
How long does it take to move all external parties off VPN accounts?
Typically 60 to 90 days: inventory discovery first, then the agentless gateway with MFA, then tier-by-tier migration with JIT workflows, and finally revocation of external VPN profiles and standing credentials once usage logs confirm the switch.
