Attacks targeting suppliers and software vendors rather than the ultimate target directly have become one of the most effective ways for attackers to compromise organizations with otherwise strong security postures.
Rather than attacking a well-defended target directly, attackers have increasingly focused on compromising a smaller software vendor or supplier with weaker security, using that initial breach as a stepping stone into the networks of every larger customer that trusts and uses the vendor’s software or services.
This approach has proven effective because it lets a single successful breach potentially compromise dozens or hundreds of downstream organizations simultaneously, all of whom may have excellent internal security but inherited risk through a trusted third-party dependency they had limited visibility into and no direct control over.
Mapping the full dependency chain remains genuinely difficult
Security teams increasingly conduct vendor risk assessments and require security attestations from suppliers, but fully mapping every software dependency and sub-dependency an organization relies on, including dependencies of dependencies several layers deep, remains a genuinely difficult and often incomplete undertaking even for well-resourced security teams.
“You can lock down your own network perfectly and still get breached through a vendor three layers removed from anything you directly control.”
With software supply chains growing more complex and interconnected rather than simpler, security teams generally describe supply chain risk as one of the harder categories to fully eliminate, even as vendor assessment practices and software bill-of-materials requirements continue to improve visibility into the dependency chains organizations actually rely on.
