Outsourcers as an entry point: third-party lessons from the CSRB

The Cyber Safety Review Board found that Lapsus$ and similar groups reached targets by going through downstream vendors, telecommunications providers and business process outsourcers, and that organizations did not always consider those third parties in their risk programs. It recommends extending prevention, detection, response and recovery to outside suppliers.

What the Board saw

Its executive summary says the groups showed skill at finding weak points, like downstream vendors or telecom providers, that gave onward access to the intended victims. They also bought valid logins from initial access brokers and the infostealer ecosystem, and targeted the third party servicers and outsourcers of their victims.

The report adds that organizations did not always include third parties and outsourcers in risk management.

Why outsourcers are attractive

An outsourcer's staff often have broad access to many customers by design: help desks, support tools and data processing. One successful social engineering call can reach a lot of data at once.

The Board's recommendations

• Plan for disruption across the whole business, including outside sources.
• Invest in prevention, detection, response and recovery with suppliers included.
• Put cybersecurity requirements into contracts so third parties meet similar standards.
• Develop and test an incident response plan, talk to law enforcement, and run after action reviews.
• Have outsourcers build information sharing relationships with industry peers.

A practical vendor program

1. List vendors with direct network access or hosted critical data, and rank them.
2. For the top tier, require phishing resistant MFA for staff who access your data, and ask how they handle help desk resets.
3. Limit what vendor accounts can reach, and review it quarterly.
4. Agree in the contract how fast they must tell you about an incident.
5. Include the vendor in at least one tabletop.

Credentials for sale

Because attackers buy valid logins, assume some of yours are already for sale. Monitor for unusual sign ins, use short lived sessions, and make sure a stolen password alone cannot do harm.

Safeguard offers vendor and supply chain visibility through SBOM and dependency scanning and compliance automation, which complement contract review. Contract terms and staff training at the supplier sit outside any tool.

A one page vendor access sheet

For each top tier vendor, record who at the vendor can reach your data, through which tools, with what authentication, and who at your company approves it. Review it every quarter and remove anything unused. This single page answers most questions after an incident and shows where an outsourcer's help desk could become a path into your systems.

Quick check

Sources

• CSRB, Review of the Attacks Associated with Lapsus$ and Related Threat Groups

Last reviewed: 19 October 2026.