Your weakest link may not be yours: third-party integrations and supply chain risk

What the big attacks have in common

In April 2025, Marks & Spencer's chairman told MPs that attackers had got in by impersonating someone to persuade a third party to reset a password. The retailer's own defences were not the way in; a trusted outside relationship was.

At the end of August 2025, a cyber attack stopped production at Jaguar Land Rover for around five weeks. Exactly how the attackers got in has not been fully disclosed, but earlier that year JLR data had reportedly been taken using login details stolen from someone outside the company who had been given access to one of its systems. The cost did not stay with JLR either. The Cyber Monitoring Centre estimated the attack cost the UK economy around £1.9bn and affected some 5,000 organisations, many of them suppliers who could not trade while the car maker was down. The government backed a loan guarantee of up to £1.5bn to give the supply chain certainty.

Two lessons follow. Your security is only as strong as the weakest organisation you have trusted with access. And an attack on someone else can stop your firm working, even if your own systems are untouched.

Your practice management system has a supply chain too

A modern practice management system rarely works alone. Around it sit document management, e-signature, identity and AML checks, client portals, payments, dictation, accounting packages, search, reporting and, increasingly, AI tools. Many are excellent, and connecting them is how firms get value from their data.

But every connection is a trust relationship. To work, each product holds something that lets it into your systems: an access token, an API key, a service account, a vendor support login. Those keys usually sit with the third party, not with you. If that third party is breached, its keys can be used against every customer that trusted it.

Take a specialist document management system, connected to your practice management system and to Microsoft 365. It can read and write matters, documents and email for the whole firm, because that is its job. If the document management vendor were compromised, its connection becomes a route into your client data and your case and matter management, without anyone touching your own front door. Your multi-factor authentication, your device rules and your staff training would not stop it, because the request arrives looking exactly like the trusted integration it is.

Where the weak links usually are

• Keys that never expire. Tokens and API keys set up at go-live and never rotated, sometimes by people who have long since left.
• Far more access than needed. An integration that needs one mailbox or one matter type, granted the whole firm because it was easier.
• Service accounts outside your controls. Accounts used by integrations, often with administrator rights, no multi-factor authentication and passwords nobody owns.
• Vendor support access. Remote access tools and support logins that are always on, rather than granted when needed and logged.
• Automation platforms. A workflow tool joining several systems together can hold the keys to all of them at once.
• Copies of your data. Integrations that copy documents and client data into their own storage, creating another place to be breached.
• Nobody's job. No list of what is connected, no owner for each connection, and no one watching what they do.

Plan for the day a supplier is hit

You cannot audit every supplier's security, and you should not try to run your firm without them. What you can do is limit what any one of them can reach, know how to cut them off, and keep working if one goes down.

1. Map every connection. Every product connected to your practice management system, Microsoft 365 and your accounts, what each can reach, where its keys are, and who in the firm owns it, with a written risk assessment for each connection and supplier that is kept up to date.
2. Give each one only what it needs. Narrow permissions to the mailboxes, sites and data the integration genuinely uses (see What did you just give it permission to do?).
3. Rotate and expire keys. Set expiry dates, rotate keys on a schedule and whenever someone with access leaves, and remove integrations nobody uses.
4. Bring service accounts under control. Named owners, the least privilege that works, and the same sign-in protections as everyone else wherever the product allows.
5. Make vendor access on request. Support access approved when needed, time-limited and logged, not left open.
6. Watch for the unusual. Alerts when an integration suddenly downloads far more than usual, or works at unusual hours.
7. Rehearse the cut-off. Know how to disconnect each integration in minutes, test it, and know what stops working when you do.
8. Put it in the contract. Notification of incidents within hours, a named list of sub-processors, your right to ask about security, and what happens to your data if the relationship ends.
9. Keep working without them. Decide how the firm would meet critical dates, answer clients and know its client account balances if a key supplier were unavailable for two weeks.

Questions to ask yourselves

1. What is connected to our practice management system, what can each connection reach, and do we have a written risk assessment for each one?
2. Would we know if one of those suppliers was hacked? Often the first a firm hears is from the supplier, or the news.
3. How quickly would we respond, and what would that look like? Who decides to cut the connection, and what stops working when we do?
4. If that supplier sits in a core process, like client onboarding or matter inception, how would we keep taking on new work, and what would each day cost us?

Questions to ask every supplier with a connection

1. Exactly what can your integration reach in our systems, and can it be narrowed?
2. Where are the keys to our systems held, who at your company can use them, and how are they protected?
3. Do you copy our data into your own storage? If so, where, and for how long?
4. How quickly would you tell us about an incident, and how would we cut your access off if we needed to?
5. Which other suppliers do you rely on to deliver this service?

The best tools, with the risk understood

None of this is an argument against integration. Best-of-breed tools connected around a practice management system are often the right answer, and a well-run supplier is usually better protected than a single firm could be. The point is to connect deliberately, knowing what each connection can reach and how you would cope if one were breached. For more on assessing the supplier behind your main system, see When the supplier is the target.

Getting outside specialists, vendors and integrators working to one plan is something we have done from the firm side. We help firms map their connections, tighten what each can reach, and build the evidence their insurers and clients increasingly ask for, independently of any vendor.