Supply chain attacks have emerged as the most common cyberthreat facing businesses over the past year, a new Kaspersky global study shows. The findings reveal that nearly every third company had to confront a supply chain threat over the past year, with supply chain risk exposure exceeding the global average in Mexico (43%), China (40%) and Spain (40%).
According to recent data from the World Economic Forum, nearly two thirds (65%) of large enterprises indicate third-party and supply chain vulnerabilities as their greatest barriers to cyber resilience in today’s interconnected digital landscape. To evaluate organizations’ vulnerability to this threat, Kaspersky’s internal market research center commissioned a global study[1] examining how these risks are evolving and the extent to which businesses around the world are being exposed.
According to the Kaspersky-commissioned survey, 31% of enterprise businesses had been impacted by a supply chain attack in the course of the past 12 months, which is more than any other type of cyberthreat. The supply chain threat is acutely focused on the most connected organizations, with large enterprises reporting the highest rate of experienced attacks — 36% — compared to counterparts from low[2] and mid-size[3] enterprise.
It’s noteworthy that it is the same group of high[4] enterprises that reports having the highest mean number of software and hardware suppliers, managing on average around 100 suppliers, which evidentially creates a vast potential attack surface. On top of that, organizations admit to granting access to their organizations’ systems to dozens of contractors: while low enterprises average about 50 contractors, for high enterprises the figure skyrockets to more than 130, facilitating another cyber risk deriving from the digital space interdependence — trusted relationship attacks, during which attackers might exploit legitimate connections between organizations.
Over the past year, trusted relationship attacks ranked in the Top 5 most common threats, having affected a quarter (25%) of companies globally. Most frequently attacks abusing existing connections between organizations were suffered by organizations in Turkey (35%), Singapore (33%) and Mexico (31%).
Supply chain and trusted relationship attacks are among the most common threats, yet the survey showed many leaders tend to underestimate them. When asked to classify threats by how dangerous they seemed, organizations focused on complex attacks like Advanced Persistent Threats (APTs), ransomware or insider threats, rather than the ones they actually face most often. Only 9% of businesses globally ranked supply chain attacks as their top concern, a strikingly low level of attention given how often these threats disrupt their operations. Similarly, just 8% named trusted relationship attacks.
Furthermore, most experts understand that a supply chain or trusted relationship breach can disrupt operations — more than half of respondents identified this as the key consequence of such attacks — yet few rank these threats as top priorities. This gap shows the risk is acknowledged in theory but not acted on in practice.
At the same time, supply chain attacks are ranked among the Top 3 most dangerous cyberthreats much more often than the global average by companies in Singapore (38%), Brazil (36%), Colombia (36%), and Mexico (35%).
“We’re operating in a digital ecosystem where every connection, every supplier, every integration becomes part of our security profile”, comments Sergey Soldatov, Head of Security Operations Center at Kaspersky. “As organizations grow more interconnected, their exposure to attacks grows with them. Against this landscape, protecting the modern enterprise now demands an ecosystem‑wide approach that strengthens not just individual systems, but the entire network of relationships that keeps business operating.”
Only by implementing preventive measures across the organization and approaching partnerships with suppliers and contractors strategically can companies reduce supply chain risks and ensure the resilience of their business.
For mitigating such risks Kaspersky recommends the following:
- Thoroughly evaluate suppliers before entering a deal. Check their cybersecurity policies, information about past incidents and compliance with industry security standards. For software and cloud services, it’s also recommended to review vulnerability data and penetration tests.
- Implement contractual security requirements. Complete regular security audits, and ensure compliance with your organization’s relevant security policies and incident notification protocols.
- Adopt preventive technological measures. Implement security practices such as the principle of least privilege, zero trust and mature identity management to reduce damage if supplier is compromised.
- Ensure continuous monitoring. Use solutions like XDR or MXDR, which are part of the Kaspersky Next product line, for real-time infrastructure monitoring and detecting anomalies in software and network traffic, depending on the availability of in-house staff members capable of carrying out such a monitoring.
- Develop an incident response plan. Make sure it covers supply chain attacks and includes steps to quickly identify and contain breaches — for example by disconnecting the supplier from company systems.
- Collaborate with suppliers on security issues. Strengthen protection on both sides and make it a shared priority.
More recommendations along with other interesting findings on business exposure to supply chain attacks are available via the link.
[1] For the report, Kaspersky internal market research center commissioned a survey, questioning 1,714 technical experts, ranking from C-level employees and vice-presidents to team leads and senior specialists from enterprises with more than 500 employees. The study covered 16 countries, including Germany, Spain, Italy, Brazil, Mexico, Colombia, Singapore, Vietnam, China, India, Indonesia, Saudi Arabia, Turkey, Egypt, the United Arab Emirates and Russia.
[2] Low enterprise: 500-1,499 employees
[3] Mid-size enterprise: 1,500-2,499 employees
[4] High enterprise: 2,500 or more employees
