The state of third-party access in cybersecurity