Auditing Trusted Vendor Connections After a Supply Chain Compromise

By Joseph Caruso, Founder, CEO and CTO, Global Digital Forensics

When Your Most Trusted Business Partner Becomes the Attack Vector

Every modern enterprise operates inside an interconnected web of third party law firms, accounting auditors, managed IT service providers, software vendors and logistics partners. Attackers exploit this B2B trust in two devastating ways. First, they compromise a vendor email tenant and reply directly inside an existing, authentic invoice conversation thread, bypassing spam filters because the message comes from a legitimate, whitelisted partner domain. Second, they compromise a contractor or MSP with persistent VPN, API or remote monitoring access into your corporate or industrial network, using that trusted bridge to deploy ransomware across your environment.

Auditing Third Party Access Paths and Reconstructing Vendor Breaches

Global Digital Forensics supports general counsel, risk managers and CISOs in both preventing and untangling third party compromises. Proactively, our penetration testers audit vendor VPN tunnels, B2B API integrations and federated identity trusts to find the paths a breach at a supplier could take into your core network. Reactively, when a supply chain incident or disputed B2B loss occurs, our forensic examiners work under counsel direction to preserve boundary firewall logs, authentication records and cross tenant email headers, showing exactly where the security failure occurred to protect your legal and contractual rights.

Whose Logs Tell the Story When the Breach Began at a Supplier

A third party compromise splits the record between two organizations that will soon have opposing interests. On your side are boundary firewall and VPN logs showing when the vendor's connection was used and from what source address, identity provider logs showing which federated or shared accounts authenticated, and endpoint artifacts on the systems the connection reached. On the vendor's side are the tenant audit logs that show when its mailbox or administrative account was taken over, the remote monitoring tool's session history and the records of what its own staff did when they noticed. Your logs can establish that the trusted path was used at a time and in a way the vendor's staff would not have used it. Only the vendor's logs can establish how the attacker came to hold those credentials.

The same split governs the hijacked invoice thread. Headers on the message you received show that it was signed by the vendor's real domain and traveled through its real mail servers, which establishes that the vendor's tenant sent it. Whether the vendor's employee or an intruder in that mailbox typed the new banking details is visible only in the vendor's sign in and audit records. Our Microsoft 365 and Google Workspace email examinations are designed to work from whichever side retains us, and the report states which conclusions rest on records we examined and which depend on records the other party has not produced.

Managed service providers deserve a separate note, because their remote monitoring tools hold sessions into every client at once. When one is compromised, the same credential or token may have been used across dozens of networks, and the provider's incident scope is written for all of its clients rather than for you. Your own records of what the tool did inside your network, the commands run and the files touched, are the only account specific to your exposure, and they should be exported before the provider pushes a remediation update that overwrites the agent's local logs. The incident response retainer agreement is where that export is arranged in advance, so the question of who may collect what is settled before anyone is in a hurry.

Contracts, Notice Clauses and the Evidence Each Party Must Keep

Counsel should direct the position toward the vendor from the first day, because the contract usually answers the questions the forensics will later test: what notice the vendor owed and when, what audit or log access rights you hold, what security obligations it accepted and how losses are allocated. A preservation letter to the vendor and to its managed service provider should go out the same day the compromise is suspected, naming the tenant audit logs, sign in logs, remote access session records, the affected mailboxes and the original messages with headers. Federal Rule of Civil Procedure 37(e) addresses electronically stored information that "should have been preserved in the anticipation or conduct of litigation" and is lost because a party "failed to take reasonable steps to preserve it," and an early written request is what later establishes that the duty was understood.

Your own preservation obligation begins at the same moment. Firewall, VPN and identity logs that roll over in days should be exported and hashed, the affected hosts should be imaged before they are rebuilt, and the people who manage the vendor relationship should be told in writing not to delete the correspondence. If the vendor is also a potential defendant, communications with it should run through counsel. The cyber due diligence practice applies the same questions before a relationship begins, and our guide to diligence before a deal closes covers the acquisition case, where the third party becomes part of your own network on closing day.

An Engagement That Works Both Sides of the Trust Boundary

Scoping inventories every standing third party connection, not only the one suspected, because a vendor compromise is often discovered through the second or third path the attacker used. VPN concentrator configurations, federated identity trusts, API keys, remote monitoring agents and shared administrative accounts are listed with their owners and their logging status. That inventory protects the client twice: it bounds the collection so the cost is predictable, and it shows the insurer and any regulator that the organization understood its own exposure. It also tends to surface connections that nobody remembered approving, which are the ones an attacker finds first.

Acquisition follows the inventory. Logs from each boundary device and identity source are exported with hashes, the hosts reached through the vendor path are imaged or triaged, and, where the vendor cooperates or the contract compels it, its tenant records are obtained through counsel. Analysis builds a single timeline across both environments and names the point of failure, which is the fact the contractual allocation turns on. Our computer forensics practice and the ransomware and data breach analysis team handle the host and network side, and the findings are written so they can become a declaration if the dispute is litigated or an exhibit if it is arbitrated.

Remediation closes the trust gap the attacker used. Standing connections become time bound and approved per session, shared accounts become named ones, remote tools are restricted to the hosts they are supposed to manage, and the logging gaps found during acquisition are fixed so the next analysis has more to work with. Validation testing confirms the vendor path can no longer reach what it reached, and the report records that confirmation alongside the findings so the board sees the problem and the fix in one document. That confirmation also gives counsel a defined end date for the exposure, which the notification analysis and the insurer both need before they can close their own files.

Avoidable Errors When a Partner Says It Was Not Them

Accepting the vendor's own summary of its incident is the costliest mistake, because the organization that caused the exposure is describing its scope. Letting the vendor remediate its tenant before its records are preserved destroys the evidence of how the mailbox was taken, and once the records are gone the vendor's version cannot be tested. Rebuilding your own affected systems before imaging them removes your half of the timeline. Continuing to pay invoices on instructions received during the window, without callback verification to a known number, compounds the loss. Each of these happens because the relationship is valued and the people involved are trusted, which is precisely why the attacker chose that path.

The corrective is procedural rather than technical. Treat the vendor as a counterparty for the duration of the analysis even if the relationship survives, route communications through counsel, require production of its records rather than its conclusions, and verify every payment instruction change by phone to a number on file before the compromise. Our guide to common digital evidence mistakes covers the general preservation errors, and the vendor specific version comes down to one rule: preserve first, then talk. The hotline at (800) 868-8189 answers 24/7 when the first indication arrives after business hours, which is when it usually does.

Audit Your Third Party Trust Boundaries Today

Call Global Digital Forensics at (800) 868-8189 to evaluate your third party network connections or analyze a suspected vendor compromise. The initial consultation is free, and our guide to cyber due diligence before a deal closes covers the same questions when the third party is an acquisition target.

Whose Logs Tell the Story When the Breach Began at a Supplier

The guide explains that a third party compromise splits the record between two organizations that will soon have opposing interests. This table shows which side of the trust boundary holds each record, what it can establish and what it cannot settle alone, so counsel can see which conclusions depend on records the other party has not produced. Read the last column before asserting where the failure occurred. Your logs can show the trusted path was used at an unusual time, but only the vendor's logs show how the credentials were taken.

The worldwide intellectual property case study describes correlating mail servers, backup media and the receiving company's records to assess what a counterparty knew, the cross organization analysis a vendor compromise requires.

How to Begin and What Happens on the First Call

Have the vendor contract with its notice, security and audit clauses, a list of the connections and accounts the vendor holds into your environment, the first indication of compromise with its timestamp, and any correspondence with the vendor since. The examiner will ask what the vendor has told you and in what form, whether preservation letters have gone out, what has been rebuilt or remediated on either side, whether counsel is directing the response and what your boundary and identity platforms log and for how long. You receive a written scope naming the sources on each side, a timing estimate and a proposal. The initial consultation is free. Call (800) 868-8189 at any hour.

Technical References and Further Reading

Related GDF pages for this work: cyber security solutions and digital forensics services.

The original article pointed readers to whitepaper on The Black Vine cyberespionage group. Those references are kept for the record.

Authorities cited in this guide: NIST Cybersecurity Framework 2.0. Sets out the Govern, Identify, Protect, Detect, Respond and Recover functions, including supply chain risk management, final publication from NIST CSRC. Federal Rule of Civil Procedure 37. Subdivision (e) governs failure to preserve electronically stored information, Cornell LII text of the rule. FTC cybersecurity guidance for small businesses. Includes vendor security guidance that boards can compare against a supplier's obligations, as published by the FTC. Microsoft Purview audit log retention policies. Documents how long tenant audit records survive by license, Microsoft Learn as read in October 2026.