[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Third-Party Risk Management](/category/third-party-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Third-Party Credentials and Vendor Risk: Safeguard Your Applications](/blog/third-party-credentials-vendor-risk) Publish date July 8, 2025 {x} minute read # Third-Party Credentials and Vendor Risk: Safeguard Your Applications [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Reviewed by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) Your primary systems aren’t the only source of damaging exposed credentials. Third-party applications employed by your organization also have privileged logins that must be protected. Cloud platforms, software as a service (SaaS), and local third party applications such as ERP systems often have administrative logins with full control. These accounts allow the people in charge of your applications to perform management tasks, and should be kept private to as few individuals as possible, with [strong password policies](/blog/the-password-security-checklist) enforced. ## How Third-Party Credentials Can Be Leaked UpGuard has [come across application credentials](/breaches/cloud-leak-accenture) in [several forms during research](/breaches/cloud-leak-viacom), but there are two common ways in which they are exposed. First, although it goes against all best practices and even basic security, organizations sometimes have documents that just list all of their applications along with credentials in a simple text document or spreadsheet. Without [encryption](/blog/encryption), these documents are like a goldmine for attackers. It seems obvious, but these documents should never be created in the first place. There are many secure methods for storing passwords, and any of them are better than a notepad document named passwords.txt. It doesn’t take a [data breach](https://www.upguard.com/blog/data-breach) of a major application company to expose your data— your own credentials being exposed is far more likely, and results in the same consequences.\ \ Secondly, we commonly find plain text application credentials in code that has been customized for organizations. Again, though deviating from best practices, which encrypt and/or store the credentials elsewhere, these are often left readable inside the code itself. This is common for integration purposes or automation, where multiple systems have to interact and require access to each other. The [principle of least privilege](/blog/principle-of-least-privilege) suggests that these integrations should use custom accounts with only the [access they need to perform their work](https://www.upguard.com/blog/access-control). Administrative application credentials should not be used for this purpose and are a shortcut that could fully jeopardize the application and its data, should those credentials be exposed. ## How To Securely Manage Third-Party Credentials Most people working in technology have encountered the elementary mistakes described above, from CTOs/CISOs to support teams to dev teams. You should consider the [risks associated with third-party credentials](https://www.upguard.com/blog/what-is-third-party-risk) both from your side, and the [vendor](/blog/third-party-vendor) side. ### Your team: Lock down your third-party credentials Avoiding using 'password.txt' seems laughably obvious, until you realize plain-text administrative credentials are [easily discoverable](https://www.upguard.com/product/breach-risk/threat-monitoring) in thousands of exposed internet-facing services. Keep administrative credentials safely locked away, and only accessible to administrators. Use lower-privileged credentials for application-level access. If you need to use third-party credentials programmatically, store them safely in a product that's designed to do so. I've had good experiences with [Vault](https://www.vaultproject.io/) and [Secret Server](https://thycotic.com/products/secret-server/). ### Your vendors: Audit your third-party vendors with security questionnaires Most organizations can get their head around locking down their third-party credentials. But what's often neglected is the importance of [auditing your third-party vendors using security questionnaires](/resources/cyber-risk-guide-to-vendor-questionnaires) (full disclosure - we help automate that!). Why? Here's an example. A key control to prevent malicious use of third-party credentials is [2FA (Two Factor Authentication)](https://www.upguard.com/blog/two-factor-authentication), so that even if the credentials are compromised, another layer of security exists between an attacker and their target. However, there's no point having a [password security checklist](/blog/the-password-security-checklist) that specifies 2FA on administrative credentials if half your vendor applications don't even support 2FA in the first place. If you're serious about assessing, monitoring and reducing your [third-party vendor](/blog/third-party-vendor) risk, you need to understand their [security posture](/blog/security-posture) fully and hold them accountable to your standards. This article is part of a series.  Read more articles in the series at [Vendor Risk: The Impact Of Data Leaks From Your Third-Party Vendors.](/blog/vendor-risk-impact-of-data-leaks-by-your-third-party-vendors) Learn more about solutions that help you with [third-party risk management](/blog/third-party-risk-management-framework). eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)