The Vendor You Forgot About Is Probably Your Biggest Cyber Risk

Ask most food and agriculture executives where they believe cyber risk comes from, and the answers are predictable. Hackers. Ransomware gangs. Nation states. Sophisticated malware.
 
Those threats are real. But in practice, many of the most disruptive cyber incidents in food processing, agriculture, seafood, and dairy do not begin with a dramatic breach. They begin quietly, through a door that leadership forgot was still open.
 
A vendor account that was never removed.
 
The Quietest, and Most Dangerous, Failure Mode
Food and agriculture operations rely heavily on vendors. Equipment maintenance providers, refrigeration specialists, automation engineers, ERP and WMS integrators, cold chain monitoring vendors, and OT support contractors often require deep, persistent access to production environments.
 
They need that access to keep lines running, temperatures stable, and systems supported. In the moment, granting access feels operationally responsible.
The problem arises later.
 
Projects end. Contracts expire. Personnel change. But access often remains.
 
Months, or even years later, no one remembers that pathway exists.
 
Attackers do.
 
A Story That Feels Uncomfortably Familiar
Consider a grain handling and storage operation preparing for peak harvest season. During a routine review following a minor network anomaly, the IT team discovered that a vendor who had serviced moisture sensors years earlier still had active VPN access.
 
The credentials were shared. Multi factor authentication was never added. The account had not been used recently, so it never triggered alarms.
 
An attacker did not need to exploit a vulnerability. They simply logged in.
 
What followed was not a data breach. It was something worse. Configuration drift. Unapproved changes. Hours of production disruption. Days of investigation to determine whether integrity had been compromised.
 
The hardest moment came when leadership asked a simple question: “Can we prove nothing important was changed?”
 
No one could answer with confidence.
 
Vendor Risk Is Operational Risk
In VisibleOps terms, vendor access is not a compliance checkbox or a procurement detail. It is an operational dependency, and unmanaged dependencies always become failure points.
Every vendor pathway is a potential blast radius multiplier. If a vendor can reach everything, so can an attacker using that vendor’s credentials.
Effective organizations treat vendor access the same way they treat production controls: governed, reviewed, logged, and owned.
 
That means:

• Approved access paths only, no direct ad hoc remote connections
• Multi factor authentication without exception
• Time bounded access windows tied to active work
• Session logging for privileged activity
• Quarterly access reviews, not annual, not optional

This is not about mistrust. It is about operational discipline.
 
Why Food Companies Are Uniquely Exposed
Food and agriculture environments blend IT systems, OT controls, IoT sensors, cloud platforms, and field equipment. Many of these systems cannot be patched quickly. Some cannot tolerate aggressive monitoring.
That reality elevates access control and segmentation from “security best practice” to primary risk controls.
 
If access is loose, everything else becomes harder.
 
Leadership Accountability Is the Differentiator
Vendor governance fails when ownership is unclear. Someone approved the access. Someone benefited from the work. Someone must own the risk.
 
Executives should insist on:

• A current vendor access register
• Named internal owners for each vendor relationship
• Evidence of quarterly access reviews
• Immediate deprovisioning when work ends

If access cannot be proven to be controlled, it should be treated as uncontrolled.
 
Trust, but Instrument
Zero Trust does not mean zero relationships. It means zero assumptions.
Vendors can still do their jobs, but through controlled, monitored pathways that protect uptime, quality, and safety.
 
The organizations that get this right rarely make headlines. They simply keep producing food reliably while others scramble to explain what went wrong.
In food and agriculture, quiet reliability is not boring. It is a competitive advantag