Guidance Is Coming, But Hackers Aren’t Waiting

Supply chains have become the soft underbelly of cybersecurity, with recent high-profile breaches demonstrating how attackers can exploit third-party vulnerabilities to infiltrate organisations. In 2022, the UK’s National Cyber Security Centre (NCSC) issued supply chain security guidance, aimed at helping organisations assess and secure their supplier networks. Still, supply chain attacks continue. 

More recently, further guidance is emerging, including the Cyber Assessment Framework (CAF) and the upcoming Cyber Security and Resilience Bill, action remains slow, and supply chain hacks continue to occur.

The UK government’s 2025 guidance on securing government supply chains highlights the need for stronger risk management, but in the interim, hackers are exploiting supply chain vulnerabilities in greater numbers than ever before. Which raises the question: is it time for businesses to push for stronger, industry-wide measures?

Why Supply Chains Are Increasingly Vulnerable

The risk associated with supply chains is escalating due to several factors:

Expanding digital ecosystems: Relying on a tapestry of third-party suppliers for cloud services, IT management, and operational support is the norma for many businesses now. However, each supplier presents a potential entry point for cyber threats.

More AI, more cyber threats:  AI is being weaponised by attackers to automate attacks, identify vulnerabilities at scale, and create highly convincing phishing campaigns. This exacerbates the challenge of securing supply chains, as AI-powered threats can adapt quickly. Similarly, if you’re adopting AI technologies and not applying rigorous due diligence to them, they come with significant risk. Don’t choose innovation over security. They need to go hand in hand.

Inadequate risk assessment:  Despite the increasing number of attacks, data from the NCSC suggests that only 13% of UK businesses regularly review the risks posed by their immediate suppliers, and just 7% assess their wider supply chain.

State-sponsored cyber espionage: Nation-state actors, such as China’s Silk Typhoon, are shifting tactics to target remote management tools and cloud services, which are often shared across multiple organisations.

Regulatory pressure and compliance challenges: As cyber threats increase, regulatory frameworks such as GDPR, NIS2, and DORA (for financial services) require stricter due diligence on suppliers, adding complexity to compliance efforts. Cybersecurity professionals are juggling a lot of different frameworks and priorities, with many indicating that they feel burnt out as reported by insights provider, Gartner.

Recent Attacks Highlighting Supply Chain Risks

Microsoft’s latest report on Silk Typhoon reveals a troubling evolution in supply chain cyber threats. The state-sponsored group has shifted its approach to target IT service providers, identity management solutions, and remote monitoring software. By exploiting unpatched applications and using stolen credentials, they can gain access to downstream customer networks and bypass traditional perimeter security measures.

Just one of many examples, the takeaway is clear: indirect access points through suppliers are an increasingly attractive vector for cybercriminals and it needs a solution.

Supply Chain Risk Regulation - What’s Happening Globally?

The European Union’s NIS2 Directive tightens security requirements for critical infrastructure providers, demanding stricter supplier risk assessments and real-time threat reporting. The United States’ Executive Order on Improving the Nation’s Cybersecurity mandates software bill of materials (SBOM) transparency for federal contractors to mitigate risks from vulnerable software components. Meanwhile, Asia-Pacific nations, including Australia and Japan, are implementing stricter cybersecurity supply chain frameworks, recognising the economic and national security implications of these attacks. 

Despite these measures, enforcement and compliance remain a challenge, with organisations needing to integrate global standards into their security strategies and juggle the evolving need and threats.

AI & The Future Of Supply Chain Cyber Threats

AI is a double-edged sword in cybersecurity with some heralding it as a future strength in threat detection, whereas others see it as potentially its greatest weakness. While organisations use AI-driven tools to detect anomalies and automate threat response, adversaries leverage AI for advanced cyberattacks. We’re seeing worrying trends:

  • AI-powered phishing campaigns can generate hyper-personalised attacks that bypass traditional detection mechanisms.
  • Machine learning models can be manipulated through adversarial attacks, potentially corrupting data integrity in AI-driven supply chain management systems.
  • Automated vulnerability discovery enables attackers to identify security gaps in supplier software much faster than traditional methods.

This means organisations must integrate AI-driven defence mechanisms, such as behaviour-based threat detection and automated patching, into their supply chain risk management strategies.

Best Practices For Securing Supply Chains

To strengthen resilience against supply chain cyber threats, taking a multi-layered approach is best, such as:

Zero Trust architecture: Adopt a Zero Trust model where no entity, internal or external, is automatically trusted. This includes enforcing least privilege access for suppliers.

Continuous third-party monitoring: Deploy continuous security monitoring solutions to detect anomalous behaviour in supplier networks.

Secure API and data access: Restrict supplier access to only the necessary systems and data and enforce API security measures.

Threat intelligence sharing: Collaborate with industry groups and government agencies to stay ahead of emerging threats.

Regular cybersecurity audits: Conduct independent audits of supplier security measures and ensure compliance with international cybersecurity standards.

Supply chain cyber risks are advancing. With the addition of AI, something that was once cutting-edge is now commonplace and opening the door to further risk. 

CAF, the Cyber Security and Resilience Bill and the supply chain guidance for public sector procurement represent a reassuring future-state when all are in play together. However, until that is in place, organisations must take charge of their own supply chain security, because waiting for the perfect alignment of guidance could mean waiting for a breach. 

Ed Bartlett is CEO at Hicomply

Image: 

You Mght Also Read:

Strengthening Britain's Cyber Defences:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« From Static Defenses To Dynamic Systems
Amazon Launches A Quantum Semiconductor Chip »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Chubb

Chubb

Chubb is the world’s largest publicly traded property and casualty insurer. Commercial services include Cyber Risk insurance.

Bastille

Bastille

Bastille’s patented software and security sensors bring visibility to devices emitting radio signals (Wi-Fi, cellular, IoT) in your organization.

Foundation Futuristic Technologies (FFT)

Foundation Futuristic Technologies (FFT)

FFT is a global leader in computer forensics and digital investigation solutions.

Korea Information Security Industry Association (KISIA)

Korea Information Security Industry Association (KISIA)

KISIA is a non-profit organization for the information security industry in Korea.

Data Recovery Services (DRS)

Data Recovery Services (DRS)

DRS provides data recovery services from media including hard disk drives, RAID, solid state disks SSD, memory sticks, USB drives, SD cards, tapes and mobile phones.

Rewertz

Rewertz

Rewterz is a cyber security company based out of Dubai, serving customers in UAE, Oman, Qatar, Bahrain, Saudi Arabia, and Pakistan.

ICTSecurity Portal

ICTSecurity Portal

The ICTSecurity Portal is an interministerial initiative in cooperation with the Austrian economy and acts as a central internet portal for topics related to security in the digital world.

LMG Security

LMG Security

LMG Security is a cybersecurity consulting, research and training firm.

Findings

Findings

Findings (formerly IDRRA) is a scalable AI powered assessment platform that streamlines security compliance across sectors, jurisdictions and regulatory frameworks.

Cybersecurity Defense Initiative (CDI) - University of Arkansas

Cybersecurity Defense Initiative (CDI) - University of Arkansas

The Cybersecurity Defense Initiative is a national cybersecurity training program, developed for technical personnel and managers who monitor and protect our nation's critical cyber infrastructures.

HSB

HSB

HSB offers insurance for equipment breakdown, cyber risk, data breach, identity recovery & employment practices liability.

CYBRScore

CYBRScore

CYBRScore is a premium, performance-based cyber skills training and assessment provider that quantifies a user’s ability to defend a network.

Hunter Strategy

Hunter Strategy

Hunter Strategy focuses on delivering solutions that are concise, scalable, and target our customer’s complex technical challenges.

WithSecure

WithSecure

WithSecure (formerly F-Secure Business) is your reliable cyber security partner, providing outcome-based cyber security that protects and enables operations.

Ministry of Electronics & Information Technology (MeitY)

Ministry of Electronics & Information Technology (MeitY)

The Ministry of Electronics & Information Technology is an executive agency responsible for IT policy, strategy and development of the electronics industry.

Beacon Technology

Beacon Technology

Beacon Technology offers a comprehensive platform consisting of XDR, VMDR, and Breach and Attack simulation tools.