Your Vendors' Agents Now Work Inside Your Business. Here's How Third-Party Risk Keeps Up.

2026-11-09 · Aldo Pietropaolo

Third-party risk programs were built around one question: what does this vendor do with our data? The questionnaires ask about encryption, access reviews, breach notification, and where the data sits.

That question now has a second half: what does this vendor's agent do in our business? The platforms you already run now ship agents that act. Salesforce Agentforce, Microsoft Copilot Studio, and Workday's AI agents are a few examples: agents that update records, answer customers, move work along, and call other systems, inside your environment and with permissions you granted. At the same time, the agents you build take direction from third-party tools, MCP servers, and content you do not control.

Third-party risk teams that build this in now will be ahead of most of their peers. In Gartner's survey of cybersecurity leaders this fall, "Fifty-four percent of organizations have no defined approach to limit AI agent access, or rely on predefined human access" (Gartner, September 2026). EY found that 26% of respondents at companies using agentic AI said their organization "cannot detect unauthorized AI agents operating internally" (EY, September 2026).

Three exposures your questionnaire should cover

1. Vendor agents acting with delegated access. An agent on a SaaS platform acts with the permissions of a user or an integration account, and connected apps and OAuth grants extend its reach into your other systems. Strong due diligence still asks whether the vendor protects your data at rest. It now also asks what the vendor's agent is allowed to do with that data, on whose behalf, and how you will know if it does more.

The platforms themselves are finding and fixing flaws in their agent features. In January 2026, ServiceNow disclosed a critical vulnerability in its AI Platform, rated 9.3, that "could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform" (CVE-2025-12420). The same month, Microsoft rated an information disclosure flaw in Copilot Studio High (CVE-2026-21520). Both were fixed, which is the process working. When an agent runs inside a platform you license, the vendor is the one who finds and fixes flaws like these, so your questionnaire should ask how they do it and how they tell you.

2. Third-party tools and content that steer your own agents. When your agent calls a vendor's tool or MCP server, or reads a partner's documents, that input shapes what it does next. A tool whose description changes, or content carrying instructions an attacker planted, can turn your agent against you. The agent then acts with your authority, so the outcome lands in your systems, and that is why these sources belong in your third-party risk program.

Government cybersecurity agencies have warned about exactly this. Joint guidance from Australia's ACSC, CISA, the NSA, and their Canadian, New Zealand, and UK counterparts, Careful adoption of agentic AI services (May 2026), puts it plainly: "Unvetted third-party components may carry excessive or unintended privileges when integrated into agent workflows." In its example, an attacker who compromises a low-risk tool in an agent's workflow can "inherit the agent’s excessive privileges, allowing them to modify contracts and approve payments without triggering alerts."

3. Evidence you can show. The EU AI Act requires deployers of high-risk systems to keep automatically generated logs "to the extent such logs are under their control" for at least six months (Article 26, Regulation (EU) 2024/1689). When the agent runs on a vendor's platform, the record of what it did may sit with the vendor. Writing access to that record into your contract is what lets you show a regulator or an auditor what happened. The record also has to be good enough to catch an attack. The same joint guidance warns that "By executing actions under a trusted agent identity, the system produces audit logs that appear legitimate and delay detection."

Five questions to add to vendor due diligence

Regulators are starting to expect this. FINRA's 2026 Annual Regulatory Oversight Report lists, among effective third-party risk practices, due diligence that includes "assessing the third-party vendor’s use of GenAI," and its section on AI agents warns that "Agents may act beyond the user’s actual or intended scope and authority" (FINRA, December 2025).

1. Which of your agents act in our environment, with whose identity, and with what permissions?
2. Can we limit what your agents may do to specific actions, records, and amounts, and require a person's approval for the rest?
3. How do you tell us when an agent's tools or behavior change?
4. How fast can we stop your agent's access, and does stopping it end the work already in progress?
5. Can we get a complete record of every action your agent took for us, in a form our auditors accept, for as long as regulation requires?

Vendors who answer these well are ready to run agents in your business. Where an answer is thin, the controls on your side carry more of the weight.

What to control on your side

You govern what reaches your systems and what your own agents do:

• Know every agent that acts on your data, including the ones that arrived inside a SaaS platform you already licensed.
• Give agents scoped, time-bound authority instead of broad integration accounts, and narrow it at every handoff between agents.
• Approve the tools and sources your agents may use, and treat a change in a tool as a reason to look again.
• Make sure you can stop an agent quickly, including work it has already started.
• Keep your own record of what every governed action did, who authorized it, and why it was allowed, so you hold the evidence yourself.

How we help

This is where our advisory work starts:

• Agent Workflow Fit & Readiness Assessment: map up to three agent workflows, including the vendor platforms and third-party tools each one depends on, and leave with a recommended next step.
• Agentic IAM Architecture: design how vendor and outside agents are identified, what authority they may hold, and how it is delegated and revoked, around the IAM, PAM, and IGA you already run, whichever vendors they are.
• Production-Readiness Pilot: test one workflow on purpose, including the ways a third-party tool or planted content could turn it, and leave with a go or no-go decision and the evidence behind it.
• Executive Briefing: bring your security, risk, and procurement leaders onto the same page about what agentic AI changes for third-party risk.

Bring us the vendor platform or agent workflow you want to bring into your third-party risk program. Request a demo and we will walk through how we would govern it.