A vendor access review is a security check that confirms what an external provider can see, change, or extract in your environment. It tests whether third-party accounts, service portals, and support tools have the minimum access needed for their job, and whether that access is still justified.
This matters because attackers often target the weakest trusted relationship rather than the main corporate network. If a vendor account has broad permissions, weak logging, or shared credentials, it can become a quiet path to sensitive records or administrative functions. Regular reviews help defenders catch excessive roles, stale accounts, missing MFA, and data access that no longer matches the contract. In practice, the review should cover permissions, data scope, session logs, and offboarding so a partner system cannot silently become an exfiltration route.