Your weakest supplier is your biggest cyber exposure

A single supply chain breach now adds $227,250 to the average cost of an incident, more than any other factor IBM tracks, and it takes longer to catch than any other cause.

Cyberattacks against medium and large companies rarely start at the front door. They start at the weakest point in the chain, and that point is almost never internal.

Reading time: 7 minutes | Keywords: third-party cyber risk, supplier risk management, cyber resilience

It can be the subcontractor with standing remote access, the software vendor with a live feed into internal systems, or the platform that half the organization logs into every morning. Third-party cyber risk is no longer a technical footnote. It is a governance decision that sits on the desk of the CEO, the COO and the CTO, not on a single IT ticket queue.

What attackers actually target in a third-party cyber risk chain

Attackers do not need to break through a well-defended network when a supplier already has a key to the door. A subcontractor with VPN access to a client's project systems, a software vendor with an API into a client's ERP, or a service provider with a line into operational controls: each one is a legitimate, authorized entry point that bypasses the defenses built for direct attacks.

This is why supply chain compromise ranked as the second most common initial attack vector in IBM's 2026 Cost of a Data Breach report, behind phishing. It is also why it is the most expensive single factor the report tracks: $227,250 above the global average of $4.99 million per breach (IBM, 2026). The cost is not abstract. It shows up in operations halted because a vendor's platform is locked, and in client contracts that include liability clauses nobody in the C-suite has re-read since signing.

Most medium-sized companies still assess their own systems more carefully than the ten or twenty vendors with standing access to them. That gap is exactly what attackers are counting on.

The weak link is every cyberattack's favorite entry point

In September 2025, a cyberattack on Collins Aerospace, the third-party provider behind check-in and boarding software at several major European airports, forced Heathrow and other hubs into manual processing for days. None of the airports were breached directly. Their shared vendor was. The disruption spread to every organization that depended on that one platform, regardless of how strong each airport's own security was.

The same mechanic applies across sectors. A single software provider, logistics platform or operations vendor often connects to dozens of client organizations at once. When that vendor is compromised, the exposure is not isolated. It is distributed across every company that trusted it with access.

This is the concern now shared by two out of three large organizations. 65% of large companies identify third-party and supply chain vulnerabilities as their greatest obstacle to cyber resilience, up 11 percentage points from 54% the year before (World Economic Forum, 2026). The trend line matters more than the single figure: the gap between what companies control directly and what they depend on indirectly is widening, not closing.

"The attacker does not need to break your firewall if your supplier already has a key to the door."

Why weakest links fail under real third-party cyber risk

Vendor risk programs tend to fail for a structural reason, not a technical one. Most risk assessments stop at tier-one suppliers, the vendors a company contracts with directly. They rarely extend to tier two or three, the subcontractors your subcontractors use, or the cloud services your software vendors rely on. Gartner describes this as a problem of scale: "the large number of multi-tier partners in an organization's supply chain has made managing third-party cyber risk a daunting task" (Gartner, 2025), and the firm now places supply chain cybersecurity at the peak of inflated expectations on its Hype Cycle, meaning expectations for quick fixes are running well ahead of what current tools can deliver.

Ownership is the second failure point. Procurement signs the vendor contract. IT manages the technical integration. Operations depends on the vendor daily. Security is asked to assess the risk after the relationship already exists. When something goes wrong, no single function owns the response, and the 258 days it takes on average to identify and contain a supplier-linked breach (IBM, 2026) reflects exactly that: nobody was watching the connection closely enough to notice it had been used against them.

"A vendor risk questionnaire completed once a year is not a security control. It is paperwork."

Incident response planning for supplier and vendor breaches

An incident response plan that only covers internal systems is incomplete for any company that depends on external vendors for daily operations. A supplier-aware response plan needs three things most companies skip: a current map of which vendors hold what access, a contractual obligation for vendors to notify you within a defined window if they are breached, and a rehearsed process for cutting off a compromised vendor's access without stopping the operations that depend on it.

The cost of skipping this is measurable. IBM's 2026 data shows that breaches taking longer than 200 days to resolve cost companies $5.65 million on average, against $4.32 million for faster containment (IBM, 2026). Supply chain breaches, at 258 days to identify and contain, sit squarely in the expensive half of that split. A rehearsed plan does not prevent the breach. It shortens the 258 days, and that is where the money is.

Key takeaways for building collective cyber resilience

Three decisions belong at the leadership level, not buried in a procurement checklist.

• Tier vendors by access, not contract size: a small vendor with admin access to core systems is a bigger exposure than a large vendor with none.
• Put security into the contract: security requirements and breach notification timelines belong in the agreement before signing, not after an incident forces the conversation.
• Rehearse the response: run at least one joint incident response exercise a year with your highest-risk vendors, so the first coordination under pressure is not during a live breach.

None of this requires new technology. It requires a decision that third-party cyber risk sits on the same agenda as revenue and safety, because for two out of three large companies, it already does (World Economic Forum, 2026).

Frequently Asked Questions

What is third-party cyber risk?

Third-party cyber risk is the exposure a company faces when a vendor, supplier, subcontractor or software provider with access to its systems or data gets breached. The attacker does not need to compromise the company directly, only the weaker link connected to it. This risk grows with every vendor integration, remote access grant and API connection a company approves.

Why is my weakest supplier my biggest cybersecurity risk?

Attackers look for the easiest way in, and a poorly secured vendor with legitimate access is often easier to breach than the company itself. Once inside through that vendor, the attacker inherits whatever access the vendor was granted. Supply chain compromise is now the second most common initial attack vector and the costliest single factor in breach costs, according to IBM's 2026 Cost of a Data Breach report.

How much does a supply chain breach actually cost?

Supply chain compromise added $227,250 above the global average breach cost in 2026, more than any other of the 30 cost factors IBM tracks in its annual report. The global average cost of a data breach reached $4.99 million in 2026, and breaches tied to a supplier tend to fall on the expensive, slow to resolve side of that average.

How long does it take to detect a breach that starts with a vendor?

Breaches that originate with a supplier or vendor take 258 days on average to identify and contain, according to IBM's 2026 report, 11 days longer than the overall average across all attack types. That delay is largely a visibility problem: most companies do not monitor vendor connections with the same attention they give their own systems.

How should a company assess supplier cybersecurity risk?

Assessment should go beyond a one-time contract questionnaire and include the level of access each vendor holds, not just the size of the contract. Companies should also look past their direct, tier-one vendors to the subcontractors and cloud services those vendors depend on, since risk frequently originates two or three tiers removed from the original agreement.

Who should own third-party cyber risk, IT or leadership?

Both, but the decision authority sits with leadership. IT manages the technical integration and security controls, while the C-suite is responsible for the contract terms, the risk tolerance and the resourcing needed to monitor vendor access on an ongoing basis. When ownership is left entirely to IT, vendor risk tends to get reviewed once a year and then forgotten.

What should be in an incident response plan for vendor breaches?

A supplier-aware incident response plan needs a current map of which vendors hold what access, a contractual requirement for vendors to notify the company within a defined window after a breach, and a rehearsed process for cutting off a compromised vendor's access without halting the operations that depend on it. Companies that rehearse this response resolve breaches faster and at a lower cost than those that do not.