Supply Chain Attacks: When Your Biggest Risk Is a Vendor You Trust

Most security programs are built to protect the organization's own perimeter. Increasingly, the more dangerous exposure sits one or two steps outside of it, in the vendors, contractors, and software suppliers an organization depends on.

A growing share of breaches, and the costliest

Roughly 15% of organizations identify a supply chain compromise as the source of a breach they experienced, making it the second most prevalent attack vector after phishing. It's also one of the most expensive: third-party and supply chain compromise ranks as the second costliest breach category, with average costs approaching $4.9 million.

The detection problem compounds the cost problem. In a recent six-month period, supply chain attacks accounted for less than 5% of all data compromises by volume, but affected nearly 700 entities and close to half of all individuals impacted across every breach category combined. These breaches also took the longest of any category to identify and contain, an average of 267 days.

Why vendors are a harder problem

An organization can control its own patch cadence, its own access reviews, its own monitoring. It has far less direct visibility into whether a payroll processor, a marketing platform, or a software dependency is doing the same. A single compromised vendor with broad access can become a single point of failure across dozens or hundreds of their customers at once, which is exactly the leverage that makes supply chain attacks attractive to sophisticated threat actors.

Building a program that catches this earlier

• A documented vendor risk assessment process for any third party with access to systems or data, not just the largest contracts.
• Contractual security requirements (breach notification timelines, minimum control standards) built into vendor agreements, not left implicit.
• A software bill of materials (SBOM) practice for critical applications, so a vulnerable dependency can be identified quickly when the next one is disclosed.
• Continuous monitoring of third-party access rather than a point-in-time review at contract signing.

None of this requires distrusting every vendor relationship. It requires treating vendor access with the same rigor as internal access, because attackers increasingly do exactly that.