Vendor privileged access management is software that controls and records the logins of a company's suppliers into its systems, under fixed rules. It is also called third-party access management or supplier access management. A vendor is an outside company that supplies parts or services.
Suppliers often need to log in to a customer's systems. An engineering supplier downloads drawings. A maintenance firm logs in to repair a machine's control system. But the supplier's laptops are not managed by the customer, and the supplier's staff are not the customer's employees. Attackers know this. They often break into a large company through a smaller supplier. This is called a supply chain attack.
The software puts four controls on each supplier login. First, the supplier's employee signs in with an identity that the customer can trust, usually through single sign-on (SSO) with multi-factor authentication (MFA). Second, the login opens only the systems and files that the contract covers. Third, it works only during approved hours, or for one approved task. Fourth, every session is recorded through privileged session recording. When the contract ends, every supplier account ends with it.
The defence and aerospace industry applies these controls most strictly. One kind of product, a shared login platform for all of a large company's suppliers, is sold mainly to that industry in the United States. There, a large company that builds aircraft or weapons for the government is called a prime contractor. It must follow government rules on how it protects technical data, and those rules pass down to every supplier that handles the data. So the prime contractor gives its suppliers access through a shared platform that records each login.
Take, for example, a precision machining firm in Hosur that makes brackets for an American aircraft maker. One of its engineers needs the latest drawing of a bracket. She logs in to the platform with her own account and a hardware security key. The platform checks that her firm's contract covers that part, and that she has completed the required training. It lets her download that one drawing, and nothing else. Every download is logged with her name, the time and the file. When the aircraft maker is audited, it can show exactly who saw each drawing.
The prime contractor also uses these records in third-party risk management (TPRM), which scores how much risk each supplier brings. Many Indian firms that make parts or software for foreign aircraft and defence electronics companies log in through such platforms every day. Indian companies use the same idea for their own vendors, for example when an IT services firm maintains a company's servers. The rule behind all of it is least privilege.