The state of the supply chain
Third-party incidents continue to affect organisations, yet supplier risk struggles to secure a place among their leading priorities. Against a backdrop of complex dependencies and changing expectations, the findings reveal a persistent disconnect between exposure and action.
The ongoing supply chain blind spot
Supply chain security remains a huge challenge for responding organisations, as evidenced by ongoing breaches. Yet the security professionals we spoke to about it seem curiously disengaged. As new regulatory requirements emerge, this could change, potentially spurring interest in voluntary compliance frameworks.
Our survey of UK and US information security professionals reveals that over half (58%) have been impacted by a third-party security incident over the past year. A fifth say they were hit more than once. This shouldn’t be surprising given the extensive supplier ecosystems that most businesses now run.
These tend to come in two flavours. The first is software. Whether organisations are developing applications in house or buying them in, open source components remain a key source of risk. Attacks on maintainers, who are often under-funded and overstretched, have ramped up this year, hitting projects with hundreds of millions of downloads. And worm-like threats are a new danger for developer teams and consumers of proprietary software alike.
But they’re not the only supply chain challenge. Vulnerabilities in third-party platforms like Klue also represent an ongoing risk. In this case and several others, hackers have exploited OAuth connections to reach even more sensitive environments like Salesforce data stores. It remains fertile ground for extortion-focused groups like ShinyHunters.
Attacks on maintainers, who are often under-funded and overstretched, have ramped up this year, hitting projects with hundreds of millions of downloads. And worm-like threats are a new danger for developer teams and consumers of proprietary software alike.
In the last 12 months, has your business been impacted because of a cybersecurity/information security incident caused by a third-party vendor or supply chain partner?
Then there are the more traditional third-party risks like contractors, managed service providers and professional services firms. In what may turn out to be the most consequential breach in recent history, an Accenture contractor was reportedly responsible for failing to patch an Oracle PeopleSoft system. This resulted in the compromise of data on thousands of FBI employees. The data trove apparently included medical and psychiatric records and home addresses of staff including counter-intelligence officers.
A worst-case scenario can manifest in other ways, such as when an outage or breach at a supplier has a real-world impact on a downstream customer. This was the case with the infamous ransomware attack on NHS supplier Synnovis a couple of years back. This kind of knock-on effect can work both ways up and down the supply chain. When Jaguar Land Rover (JLR) suffered a several-week outage due to ransomware last year, thousands of its suppliers were plunged into a liquidity crisis.
Why hackers love suppliers
Supply chain attacks remain enduringly popular among threat actors because the security posture of third parties is often less mature, and by striking once, hackers can impact multiple downstream customers for a bigger payout. For similar reasons, such relationships remain frustratingly challenging for CISOs to manage.
The extent of modern supply chains can be vast. Over a quarter (28%) of our respondents cite “IT sprawl” as a major challenge. And shadow IT makes it harder still to understand and manage every single supplier, and fourth- and fifth-party relationships that may be further obscured by tech dependencies. Downloading or accessing unapproved software is cited by respondents as one of the top-three mistakes made by employees over the past 12 months (32%).
Even if security teams do get a handle on supplier risk, those risks tend to change frequently in their organisation, as new threats emerge, configurations change, processes evolve and controls drift. Mergers and acquisition (M&A) activity is another reason why static, point-in-time questionnaires are no longer fit for purpose in these environments.
Downloading or accessing unapproved software is cited by respondents as one of the top-three mistakes made by employees over the past 12 months (32%).
Using generative AI tools (e.g. ChatGPT, Copilot) without organisational permission or guidance
Clicking on suspicious links or attachments
Shadow IT – downloading or accessing unapproved software, extensions, or services
AI – Leaking confidential information via an AI tool
Using public Wi-Fi networks for work purposes
What, if anything, are the common types of information security/cybersecurity mistakes made by your employees in the last 12 months? (top responses)
Awareness doesn’t translate into action
Respondents to our survey cite outages (33%), data breaches (32%), delay or disruption (31%) financial loss (31%), and business interruption (29%) as the main outcomes of supply chain incidents. Given many have experienced threats like these over the past year, it’s unclear why only 16% rank supply-chain compromise a top-three threat. And why just 18% are making third-party and vendor risk management a priority for the coming year.
Only a quarter (25%) say that securing the supply chain is their biggest challenge. And less than a third (31%) have responded to emerging threats by reviewing their suppliers’ exposure to such threats.
Yet that may be about to change; at least in the UK. According to a World Economic Forum (WEF) report published last year, over half (54%) of global organisations identify supply chain challenges as their biggest barrier to achieving cyber resilience.
The government appears to agree. In October 2025 it sent a ministerial letter to all companies in the FTSE100 and FTSE250, as well as other leading firms, urging them to require adoption of Cyber Essentials across the supply chain. A voluntary Cyber Resilience Pledge initiative launched in April 2026 does the same.
Given many have experienced threats like these over the past year, it’s unclear why only 16% rank supply-chain compromise a top-three threat. And why just 18% are making third-party and vendor risk management a priority for the coming year.
Businesses may soon not have the luxury of choice. The Cyber Security and Resilience Bill promises to introduce more rigorous requirements for in-scope organisations to manage third-party risk, including non-IT suppliers. These requirements are yet to be confirmed, and will ultimately be introduced in secondary legislation. But they are likely to drive adoption of best practice standards across supply chains.
What were the impacts or repercussions of the third-party or vendor-related incident(s)?
According to our survey, relatively few currently require Cyber Essentials (37%), ISO 27001 (28%) and ISO 42001 (20%) of suppliers. That’s a wasted opportunity to carve out competitive advantage and build resilience, given the share of respondents that have suffered a breach via their suppliers over the past year.
Currently only a fifth (19%) of organisations say they experience increased scrutiny from their partners or suppliers following a breach. That figure will also no doubt surge in time as third-party risk management before, during and after incidents becomes a regulatory responsibility for more businesses.
Which information security standards or regulations, if any, do you require of your suppliers to do business with them?
