THE TAKE
One of the more important cybersecurity stories this month involves an attack that didn't require compromising an employee's password. The attackers used access that organizations had already granted to a trusted technology provider.
On October 21, Microsoft disclosed that a China-state-aligned threat group used an AI-powered offensive security framework to accelerate attacks involving compromised ConnectWise application credentials. The attackers attempted access across more than 2,250 Microsoft 365 tenants. Across the broader ARTEX-driven campaign, Microsoft observed multiple instances where the time from initial targeting to privileged cloud access was less than three hours. The scale matters, but what concerns me more is how the access worked. These were application identities operating through permissions customers had already approved.
We've spent years strengthening MFA, privileged access, and identity governance for employees. Meanwhile, our environments have accumulated service accounts, integrations, API connections, and third-party applications that often receive far less scrutiny. AI is now giving attackers the ability to exploit those existing weaknesses at machine speed. Boards need to understand that third-party risk doesn't end when the vendor passes the security assessment.
THREE THINGS BOARDS SHOULD KNOW
- Trusted applications can become privileged attack paths — A compromised vendor credential can provide access to enterprise systems without a traditional employee login.
- AI changes the speed of an otherwise familiar attack — Credential abuse, reconnaissance, and privilege escalation are not new, but automating them significantly reduces the time defenders have to respond.
- Disconnecting the vendor may not remove the attacker — Unauthorized credentials, permissions, or applications established during an intrusion can survive unless the customer environment is independently investigated and remediated.
THE QUESTION I'M HEARING
"We already have MFA and third-party risk assessments. What are we missing?"
The visibility and control of non-human identities. MFA remains essential, but it doesn't solve the problem of compromised application credentials operating through previously authorized connections. Organizations need to know which third-party applications have access to their environments, what those applications can do, and whether those permissions remain justified.
This also changes how we approach vendor risk. Annual questionnaires and contractual security requirements are not enough when an application holds persistent access to email, files, identities, or cloud administration. That access needs continuous monitoring, periodic entitlement reviews, credential governance, and a clear process for investigating suspicious activity. The same discipline should apply to internal service accounts and AI agents.
My recommendation is to make non-human identity risk a visible part of the enterprise security program. Have management identify the most privileged external integrations, validate their permissions, and demonstrate how unauthorized application activity would be detected and contained. A trusted vendor relationship should never mean unlimited or unmonitored technical trust.
THE BOTTOM LINE
Third-party risk doesn't stop at the vendor's security posture. It extends to every permission and identity that vendor holds inside your environment.
The next serious breach may come through access your organization already approved.