Third-party and vendor access risk

ManySignal monitors all identity provider authentication events for vendor user accounts (identified by domain, group membership, or attribute tags). Vendor sessions are compared to their contractual access scope: expected systems, expected hours, expected data categories. Deviations — off-hours access, access to systems outside the vendor's scope, bulk data downloads — trigger alerts enriched with the vendor's contract context.

Yes. Indicators of vendor compromise include: authentication from unusual geographic locations, changes to access patterns inconsistent with contract scope, use of unexpected tools or user agents, and activity patterns that match known attack TTPs (reconnaissance, lateral movement). ManySignal also monitors threat intelligence for compromise notifications related to specific vendor organizations.

ManySignal monitors for direct access patterns that bypass the identity provider: direct database connections from external IPs, SSH access from vendor IP ranges, VPN connections using vendor-assigned credentials. These are flagged as higher risk than IdP-authenticated sessions because they lack MFA enforcement and session policy controls.

Yes. ManySignal integrates with OneTrust, ServiceNow GRC, Archer, and similar platforms to pull vendor risk ratings, contract access scope definitions, and ongoing assessment results. This context is used to adjust alert severity: a suspicious access event from a high-risk vendor with overdue security assessment is scored higher than the same event from a low-risk vendor with clean recent assessment.

ManySignal's vendor access report covers any configured time period: all vendor authentication events, access scope vs. contractual entitlement, any anomalous behavior detected, and containment actions taken. Reports are formatted for SOC 2 Type II auditor review (vendor management controls, CC9.2), ISO 27001 Annex A.15 (supplier relationships), and internal governance board review. Reports can be auto-generated on a monthly or quarterly schedule.

The detection fires an alert immediately with the vendor context attached: vendor name, access scope, contract status, and historical access patterns. The Triage agent evaluates whether the location anomaly is consistent with vendor team travel patterns. For confirmed anomalies, the response workflow options include: suspend the vendor's SSO session, require re-authentication with additional verification, or revoke temporary access credentials — all from the ManySignal case view.

ManySignal's focus is monitoring active vendor access, not pre-access security assessments. For pre-access vendor risk scoring, ManySignal integrates with third-party risk platforms (BitSight, SecurityScorecard, UpGuard) and can pull vendor risk ratings as context for access decisions. Once a vendor is granted access and active in the environment, ManySignal's continuous behavioral monitoring provides ongoing assurance that access is being used within its intended scope.

Shared credentials are a significant risk because they prevent individual user attribution. ManySignal flags shared credential usage (multiple simultaneous sessions from different geographic locations, session switching patterns inconsistent with a single user) and can correlate shared account activity with the list of individuals known to have the credentials. The recommendation workflow suggests migrating vendors to individual SSO-federated accounts with proper attribution.