The supply chain risk landscape in numbers: 50% of organizations are changing third-party risk strategy, yet supply chain ranks 11th of 14 security budget priorities (PwC Global Digital Trust Insights). Recent supply chain compromises show why evidence-based, continuous supplier visibility now matters.
PwC surveyed 3,934 business and technology leaders across 71 countries for its 2027 Global Digital Trust Insights. Half say geopolitics is changing how they manage vendor and supply chain risk, more than any other part of their cyber strategy. Among security leaders, though, supply chain and third-party risk ranks 11th of 14 budget priorities.
I read the report in the same week Microsoft published its analysis of the ConnectWise compromise and LiteLLM pulled a poisoned release from PyPI. That timing made it read less like a forecast and more like a description of what was already happening in our industry.
Most of the report is about AI, and rightly so. Spread across its charts, though, is a pattern I hear in almost every conversation I have with CISOs. Everyone agrees the supply chain is where the exposure sits. Very few have changed how they measure or fund it.
Where does the supply chain show up in PwC's findings?
Third-party breaches rank third among the threats security leaders feel least prepared for (34%), and software supply chain compromise ranks fifth (31%). Supply chain is the area where cyber strategy is changing most in response to geopolitics (50%). In the budget, it sits near the bottom.
The AI findings belong in this conversation too. Attacks on AI systems are the number one preparedness gap at 50%, and PwC points out that AI-driven operations depend more and more on external models, platforms, data and services. Those are suppliers. The report also notes that frontier AI lets people outside engineering ship code and cloud configurations, often without a security review. That's shadow IT with a faster on-ramp, and every one of those side projects brings in suppliers nobody registered.
Then look at what gets reported upward. When PwC asked which metrics best show the board that risk is going down, third-party and supply chain risk scores landed near the bottom for security leaders (36%) and tied for last for CEOs and boards (33%). Compliance audit results came first for both groups. So the board isn't asking for supplier exposure, and security teams aren't bringing it to them.
Why did October's attacks land exactly where PwC measured the weakness?
Because both used trust the victims had already granted. Storm-0940 used credentials for ConnectWise's multi-tenant cloud apps to sign in to customer Microsoft 365 tenants. LiteLLM, an AI gateway with about 23 million weekly downloads, shipped malware through its own release pipeline. Neither attack needed a flaw in the victim's own systems.
The detail in Microsoft's write-up is worth reading slowly. Microsoft attributes the campaign to Storm-0940, a China-aligned group, which ran it with ARTEX, an open-source multi-agent framework for AI-driven penetration testing. It saw sign-in attempts against more than 2,250 tenants, and in several cases the time from first targeting to privileged cloud access was under three hours. Target sectors included government, defense, energy, financial services and think tanks.
The LiteLLM compromise was the project's second this year. The malicious build stole cloud credentials and the auth files of AI coding assistants, and within hours the attacker was testing stolen AWS credentials against hosted AI models. People tracking October's incidents saw the same thing across a long list of cases: stolen tokens and legitimate release channels did the work, rarely a zero-day. PHP2Shell, which hit the same month, was a genuine flaw, but much of the exposed PHP sat on supplier servers nobody had listed, as our CPO Stephane Konarkowski explains in PHP2Shell and the PHP your suppliers run for you.
Put that next to PwC's numbers and the two biggest preparedness gaps in the survey, attacks on AI systems and third-party breaches, turn out to be one gap. The AI tools companies adopt fastest are third-party software, often wired into production with long-lived credentials and broad permissions.
There's a speed problem as well. Attackers are already running agents. PwC found only 22% of organizations would let AI agents carry out defensive actions on their own. I understand the caution, and I share some of it. But it means the speed advantage currently sits with the attacker, and a supplier review that happens once a year has no chance of keeping up with a campaign that moves in hours.
Why isn't more budget going to supply chain risk?
Because most third-party risk programs were built to satisfy an auditor, and they do that well.
Compliance audit results are the metric both security leaders and boards trust most. A completed questionnaire satisfies that metric, so the program looks healthy right up until a supplier's token gets stolen.
I've said for years that third-party risk management drifted into compliance theater. You send a spreadsheet, the supplier fills it in, you tick the box. A questionnaire is only as good as what's in someone's head on the day they answer it, and it starts going stale the moment it's submitted. Compliance is the floor, yet most programs treat it as the ceiling.
The customer conversations we've had this autumn say the same. One CISO told us the two things that keep him up at night are a supplier connected to his estate that never went through assessment, and a supplier that was assessed once and never looked at again.
When we run discovery for organizations, 20 to 25% of the suppliers we find are typically missing from their registers. In one proof of value, the security team learned about more than 200 domains run by a different department.
PwC's data on context points the same way. Only 37% of organizations correlate threat intelligence with their own asset and vulnerability data across the whole business, and just 5% have put all eight of the risk-context measures PwC surveyed in place. Intelligence without context is noise. In one assessment we ran, a single well-known provider had 2,005 generic findings. Two of them mattered, given how that customer actually used the provider.
What does this mean for governments and critical infrastructure?
Public bodies carry the same supplier dependencies, often with less visibility into them. Government made up only 3% of PwC's respondents, yet Storm-0940 went after government, military, defense and think tank targets through a commercial IT provider. NIS2 and DORA already require organizations to manage ICT supplier risk, and October gave supervisors fresh examples of why.
The concentration point is where the public and private sectors meet. PwC found that 54% of security and risk leaders are moving to multi-cloud or hybrid strategies and 47% are adding regional redundancy, while others localize infrastructure in specific jurisdictions. Those are reasonable moves. Moving a workload to a European region doesn't change which SaaS tools and open-source libraries run on top of it, though.
The same few hundred providers serve banks, hospitals, ministries and the suppliers to all of them. When something breaks at that layer, sector boundaries stop mattering. A ministry and a retailer that share a backup provider share an incident. That's the part of supply chain risk no single organization can manage alone, and it's why I expect governments to ask more often for evidence of dependency mapping at a country-level.
What should security leaders change first?
Start from what the business can't operate without, then map every supplier that touches it, using outside-in evidence instead of declarations. PwC's own playbook recommends supplementing vendor self-attestation with independent, always-on signals.
I'd go a step further and assess each supplier by how you're actually connected to it. Digital Proximity is the measure we developed to achieve that kind of relationship-based scoring.
A few changes make that concrete:
- Define your minimum viable company, PwC's phrase for the smallest set of capabilities you need to keep operating through disruption. Then map the suppliers and fourth parties each of those capabilities depends on. Only 39% of organizations have fully formalized continuity plans for cyber threats, and most of those plans assume suppliers will be there.
- Inventory the access third parties already hold in your environment: app registrations, OAuth grants, API tokens, service accounts. The ConnectWise campaign didn't break in. It used permissions customers had granted years earlier.
- Treat offboarding as seriously as onboarding. When a relationship ends, the scripts, DNS records, API connections and stored credentials often stay. We see lingering connections to former suppliers in almost every estate we map.
- Trigger supplier reviews on change rather than the calendar. A new subdomain, a changed script, a dropped certification or a sanctions event should prompt a look within days.
- Report supplier exposure in business terms, as in which critical service depends on which supplier and what happens if it fails. If it doesn't reach the board in a form the board can act on, it won't compete for budget against AI and cloud.
PwC makes one recommendation I'd underline: assess vendor concentration the way an attacker would, by tracing the paths and shared infrastructure that let one incident cascade across vendors that look independent on paper. That's the exact question October's incidents asked of thousands of organizations. Most could only answer it by searching spreadsheets.
Where ThingsRecon fits
This is the problem we built ThingsRecon around. We call it Supply Chain Intelligence: starting from just a domain, we discover the suppliers digitally connected to an organization from the outside, including the ones nobody registered, and keep watching them.
Our Digital Proximity scoring rates the relationship between you and a supplier instead of giving the supplier a generic grade, which is how 2,005 findings become two. We wrote more about why we had to invent that metric here, and about why a good vendor rating doesn't protect you in this post.
It works alongside your GRC platform and threat intelligence feed and gives them the dependency map they're missing. If you want the wider numbers, our Digital Supply Chain Attack Statistics 2026 report pulls them together, and five things most supply chain risk teams overlook is a practical starting checklist.
If you'd like to see what your own supplier map looks like from the outside, we can run it from just your domain. Talk to us about Supply Chain Intelligence.
