There is a particular kind of discovery that doesn’t arrive with sirens and flashing lights.
It arrives quietly, almost as a footnote — an item buried in a forensic report, flagged in a calm, professional tone by someone who has clearly seen this before and is choosing their words carefully because they know the reaction is going to be uncomfortable.
“While we were in the environment for the ransomware investigation,” the Xpert team said, approximately one week after the 2 AM incident had been resolved, “we found something else you should know about.”
Xavier set down his coffee.
The Footnote
The ransomware recovery had gone well. Systems were restored, endpoint detection was upgraded, Kevin had completed a phishing awareness training that he described, with admirable self-awareness, as “the most important forty-five minutes of my professional life.” Meridian had come through the incident better than most companies do, and the organization was settling back into operational rhythm.
The Xpert team’s post-incident forensic review was intended to be a closeout exercise — a final sweep to confirm that no remnants of the malware remained and that the environment was clean.
Instead, it turned into something else entirely.
During the review, Xpert’s team identified an active admin-level credential in Meridian’s environment that didn’t belong to any current employee. It was attached to an account they didn’t immediately recognize. When they traced it back, they found it belonged to a third-party technology firm called Crestview Solutions — a vendor Meridian had engaged eighteen months earlier for a systems integration project.
The project had been completed. The invoice had been paid. The relationship had concluded.
The access had never been revoked.
Crestview Solutions still had admin-level entry into a significant portion of Meridian’s technical environment — the kind of access that, in the wrong hands, would allow someone to view, modify, or extract virtually anything on the network.
Xavier asked the question that needed to be asked:
“Is this the only one?”
The answer was no.
The Audit
Xpert conducted a full vendor access audit across Meridian’s environment. What they found was not the result of malice or negligence on any individual’s part. It was the result of something more mundane and, in many ways, more dangerous: the complete absence of a process for managing vendor access across its full lifecycle.
The audit surfaced four vendor accounts with active credentials in Meridian’s systems. Three of them had not been accessed in over a year. One of them, on closer examination, belonged to a vendor whose company had been acquired by a larger firm eight months earlier — meaning the credentials theoretically existed within an entirely different organization’s infrastructure, under entirely different ownership, with entirely different security practices.
Nobody at Meridian had known any of this. The vendors had been brought in, given the access they needed to do their work, and then — when the work was done and everyone moved on — simply never removed from the environment.
There was no offboarding checklist for vendors. No expiration date on access credentials. No periodic review of who had standing access to Meridian’s systems. No one person accountable for knowing the answer to the question: who can get into our environment right now?
The answer, it turned out, included at least three companies that no longer worked for them.
Why This Matters More Than It Sounds
At first glance, unused vendor credentials might sound like a housekeeping issue rather than a security crisis. The accounts hadn’t been accessed. Nothing had happened. Crestview Solutions, by all accounts, was a legitimate firm with no history of malicious behavior.
But the Xpert team walked Xavier through the threat model, and the housekeeping framing dissolved quickly.
Vendor companies get breached too. If Crestview Solutions — or any of the other vendors with active credentials — suffered their own cyberattack, the credentials stored in their systems could be extracted and used to access Meridian’s environment. Meridian’s security would be only as strong as the weakest security posture among every vendor with an active account. That’s a significant expansion of the attack surface, and it’s entirely invisible without an audit.
The acquired vendor scenario. The vendor that had been acquired presented a specific and uncomfortable scenario. The credentials existed somewhere within a larger organization that Meridian had never vetted, never contracted with, and had no relationship with whatsoever. That organization had admin access to Meridian’s environment not because anyone had granted it, but because nobody had revoked it.
Principle of least privilege — and what happens when nobody enforces it. The admin-level access that had been granted to Crestview Solutions during the integration project was appropriate for the scope of the work at the time. It was not appropriate eighteen months after the project concluded. The right level of access for a vendor is exactly what they need to do their job — no more, no less, and for no longer than the duration of the engagement.
When Xavier understood the acquired vendor scenario fully, he was quiet for a moment.
Then he said: “So a company we’ve never heard of has admin access to our systems.”
“Had,” the Xpert team corrected. “We’ve already revoked it.”
How Xpert Fixed It
The immediate remediation was straightforward: all four inactive vendor accounts were identified, documented, and deactivated within hours of the audit findings. The environment was verified clean of any unauthorized activity associated with those accounts.
The structural fix took longer and mattered more.
A vendor access management process. Xpert worked with Meridian to establish a formal lifecycle for vendor access — from request to revocation. When a vendor needed access to Meridian’s environment going forward, the request went through a defined process: documented scope, minimum necessary permissions, a named internal owner, and a hard expiration date tied to the project timeline. Access didn’t live indefinitely. It lived until the work was done.
A vendor access register. A living document — maintained by Xpert and reviewed quarterly — that tracked every third-party entity with any level of access to Meridian’s environment, what access they had, why they had it, and when it was scheduled to expire. Xavier could look at it at any moment and know exactly who had keys to the building.
Least privilege enforcement. A review of all standing access across the environment — vendor and employee alike — against the principle of least privilege: every account should have access to exactly what it needs to perform its function and nothing more. The audit identified several internal accounts that had accumulated permissions over time beyond what their current roles required. Those were adjusted as well.
Automated deprovisioning triggers. For vendor accounts tied to specific projects, Xpert configured automated alerts when project end dates approached, prompting a review and revocation workflow before accounts became stale. No more relying on someone to remember to close the door.
Sandra, Meridian’s CFO, sat in on the debrief for this one. Afterward, she made a note to have Xpert review the vendor contracts she managed through the finance department — a voluntary expansion of the audit scope that Xavier noted as exactly the kind of organizational behavior change good security culture produces.
The Quiet Threat Nobody Talks About
The password incident had a clear, dramatic trigger — a locked system, a frozen finance team, a looming month-end deadline. The ransomware had a 2 AM phone call. The laptop had a panicked call from a rental car line.
This one had a footnote in a forensic report.
And in some ways, that’s what made it the most instructive incident yet. Because the threats that make noise are the ones organizations eventually address. The threats that sit silently in the background — an unused account here, an unreviewed permission there — are the ones that accumulate unnoticed until someone looks closely enough to find them.
Xpert looked closely. They found things Meridian didn’t know were there. And then they built a system to make sure the same thing couldn’t accumulate again.
That’s not a reactive service. That’s what a genuine IT partnership looks like.
Who has access to your environment right now?
If the honest answer is “I’m not entirely sure” — that’s the answer worth doing something about.
Coming up in the next installment of The Xavier Chronicles: Meridian’s communication setup is a patchwork of personal accounts, unlicensed platforms, and one Google Meet link from 2021 that somehow keeps showing up in board meeting invites. A compliance concern from a board member forces the conversation nobody wanted to have.
Meridian Group is a fictional company. Unrevoked third-party vendor access is one of the most consistently overlooked security vulnerabilities in small and mid-sized business environments. Xpert Technologies helps growing companies in Metro Detroit maintain complete visibility and control over who has access to their systems — and build the processes to keep it that way.
When did you last audit your vendor access? Maybe it’s time to chat with an Xpert.
#CyberSecurity #VendorManagement #ZeroTrust #AccessControl #ITSecurity #MetroDetroit #XpertTechnologies
