Your suppliers are inside your systems. Are they all governed?

Think about everyone who touches your systems but doesn't appear on your payroll. Logistics partners, payment vendors, agency staff, IT contractors, and franchise partners.

Now ask yourself: how confident are you that you know exactly what each of them can access, and whether they still need it?

For most UK and Ireland retailers, that answer is uncomfortable. Third-party identities have quietly become one of the largest and least-governed parts of the retail attack surface. In this post, we explore why supplier access carries so much hidden risk, and how leading retailers are finally closing the gap.

The employee/non-employee governance gap

Retail can't run without third parties. But while employee access usually has a clear, HR-driven lifecycle (joiner, mover, leaver), third-party access rarely works that way.

Contractors are often onboarded through ad hoc IT tickets, granted broad permissions "to be safe," and then forgotten. The project ends, the contract lapses, but the access stays live. This creates a dangerous pattern across the retail estate:

• Retained access: Accounts stay active long after the work is done because no one owns switching them off.
• Overprivileged access: Vendors get more access than they need, often cloned from broad templates to save time.
• Unmonitored sprawl: Because non-employees sit outside core HR processes, their access escapes standard audits.

Attackers understand this gap perfectly. A lingering supplier account with weak oversight is a softer target than a governed employee login. Compromise one over-privileged vendor, and an attacker can reach point-of-sale systems, supply chain platforms, or customer data—all without touching an employee credential.

Takeaway: Ungoverned third-party access doesn't just add risk. It adds risk you can't see.

Why MFA doesn't close the gap

It's tempting to assume multi-factor authentication (MFA) neutralises third-party risk. It doesn't.

MFA confirms that whoever logged in is who they claim to be. That's a vital layer of security. But it tells you nothing about whether that contractor should still have access, or whether their permissions are far broader than their current task requires. A dormant supplier account with valid credentials will still pass an MFA check.

Third-party risk is a governance problem. It's about visibility, least privilege, and lifecycle control—not just proving identity at the point of login.

Takeaway: Authentication verifies the person. Governance decides whether they should have access, and for how long.

Bringing third parties into the fold: ASDA and Specsavers

The good news is that this is a solved problem. The goal is to bring non-employee identities into the same governed, automated model you use for employees. Strong third-party governance means access is policy-based (least privilege from day one), temporary by default (tied to contract dates so it expires automatically), and fully auditable.

Leading UK retailers are already proving this model works using SailPoint Non-Employee Risk Management:

• ASDA faced this challenge head-on after its demerger from Walmart. Alongside 138,000 employees, ASDA had to govern roughly 6,000 contractors who didn't belong in the standard HR system. By bringing them onto SailPoint, third-party access stopped being a manual IT battle. Today, a lean identity team of just five people manages both employees and non-employees to a consistent, secure standard.
• Specsavers operates a complex joint-venture model with over 2,500 locally owned stores. They needed to manage roughly 1,000 third parties on top of their corporate users, previously handled through a tangle of service desk forms. By bringing this population under automated, role-based governance, Specsavers cleaned up its data and recovered 2,000 Microsoft 365 licences tied to duplicates and leavers.

Takeaway: Governing third parties well isn't harder than governing employees. It's the exact same discipline, managed on a single platform.

The bottom line for UKI retailers

Your suppliers and contractors are inside your systems every day. The question isn't whether they need access; it's whether that access is governed.

If your third-party access is persistent, over-privileged, and unmonitored, it is quietly widening your attack surface. The retailers pulling ahead treat non-employee identities as a first-class part of their identity programme, not an HR afterthought. Give your third parties the same governance you give your employees, and turn a hidden risk into a controlled one.

Take action

Want to go deeper on this? Watch this 45-minute on-demand webinar, Retail identity security in 2026: reducing risk without slowing growth, for a practical look at where retail identity risk hides and how to close it.