Last Mile — Logistics Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 logistics organisations across Belgium, the Netherlands & the UK
Why logistics operators carry compounding cyber exposure
Modern logistics operations are digital at their core. Warehouse management systems, transport management platforms, track-and-trace portals, customs and compliance integrations, carrier APIs, and customer self-service portals create sprawling web estates that span dozens — sometimes hundreds — of publicly reachable applications. Each touchpoint is an entry point that sits in the open internet, exposed to reconnaissance and exploitation without an attacker ever needing to breach a perimeter.
Logistics operators also occupy a critical node in global supply chains. They hold freight data, customer PII, EDI connections to hundreds of clients and partners, and in many cases direct integrations with customs authorities and port systems. Compromise of a logistics operator's web estate can ripple outward: spoofed shipment notifications, fraudulent invoice diversion, and access to customer order data are all credible outcomes from external attack surface weaknesses that could be identified and exploited in hours.
This report draws on simultaneous scans of five logistics organisations across Belgium, the Netherlands, and the United Kingdom — spanning automated warehouse systems, port and chemical transport, e-commerce fulfilment, contract logistics, and temperature-controlled cargo operations. The findings reveal a sector where software vulnerabilities are pervasive across all five operators, where security headers are missing from four of five organisations, and where one operator's email infrastructure is critically unprotected — leaving its domains open to spoofing and fraud.
All organisations in this report are anonymised. Technology suppliers and infrastructure providers are named as they appear on the external attack surface.
How do logistics operators compare?
ThingsRecon scanned five logistics organisations simultaneously. Four carry an overall score of C; one carries a D — the only D observed across the benchmark. The variation in individual risk indicators is striking: software risk is D at four of five organisations, header security is D at four of five, and one operator carries a sector-worst Email F rating. Org D, the largest estate scanned, runs 338 publicly exposed applications with 139 Fix Now priorities — the highest single-organisation Fix Now count in this benchmark.
Software D
SSL C (3×F-rated)
Software D · Header D
92 F-rated apps
Software D
Header D: 4/5 orgs
Where the sector is consistently exposed
Looking across all five organisations simultaneously, two risk categories stand out as systemic failures rather than isolated weaknesses. Software vulnerabilities and missing security headers appear at nearly every operator — irrespective of estate size or geography — pointing to sector-level underinvestment in web security hygiene.
The structural vulnerabilities defining this sector
The five organisations scanned collectively expose 476 web applications to the public internet. Org D alone runs 338 — of which 128 carry F or D ratings. At this scale, consistent security policy enforcement becomes operationally difficult, and gaps multiply silently across teams and geographies.
Fragmented Application Estates
The five organisations scanned collectively expose 476 web applications to the public internet. Org D alone runs 338 — of which 128 carry F or D ratings. At this scale, consistent security policy enforcement becomes operationally difficult, and gaps multiply silently across teams and geographies.
Software Component Debt
Four of five logistics operators carry D-rated software risk. Unpatched JavaScript libraries, outdated CMS versions, and vulnerable server components embedded in logistics portals provide attackers with known, documented exploit paths — without requiring any novel technique. This is the sector's highest-volume Fix Now category, with 91 immediate remediation items identified.
Email Infrastructure Blind Spot
Org E's F-rated email configuration means its domain can be weaponised to send fraudulent shipping notifications, delivery confirmation requests, or payment instructions without technical detection. In a sector where email is the primary customer communication channel, this is a direct enabler of business email compromise at scale — targeting the operator's entire customer and partner network.
Logistics operators providing transport and warehousing services qualify as important entities under NIS2 Annex II (transport sector). The Directive — enforceable across EU member states from October 2024 — requires systematic risk management, incident reporting within 24 hours, and demonstrable control over supply chain cyber risks. Email authentication failures, widespread software vulnerabilities, and unprotected public-facing applications each represent concrete NIS2 compliance gaps that national competent authorities are empowered to investigate and sanction.
The technology layer connecting logistics operators
975 supplier connections were mapped across the five organisations. Four suppliers — Microsoft, Google, GitHub, and jQuery — appear in every organisation's external estate, forming a shared technology layer that underpins logistics operations across Belgium, the Netherlands, and the UK regardless of business model or estate size.
Microsoft's universal presence across this logistics benchmark is both a strength and a concentration risk. Its cloud infrastructure, mail services, and authentication platforms are embedded in the operational fabric of every organisation scanned. At Org E, where Microsoft proximity peaks at 59% and email authentication is rated F, a compromise or spoofing of Microsoft-associated mail infrastructure could cascade across the entire customer and partner network. Logistics operators relying on Microsoft for both operational tooling and external communications should treat email authentication hardening as a non-negotiable baseline control.
Priority issues identified across the logistics benchmark
- Fix NowSoftware vulnerabilities sector-wide — All five logistics organisations carry D-rated software risk. 91 software-linked Fix Now priorities identified across the benchmark, driven by outdated JavaScript libraries (including jQuery) and unpatched server components embedded in logistics portals, booking systems, and customer-facing applications. These represent known CVEs with documented exploit paths.
- Fix NowOrg D — 139 Fix Now priorities across 338 applications — The sector's largest estate carries the highest single-organisation Fix Now count in this benchmark. Of 338 publicly reachable applications, 92 are F-rated and 36 carry D ratings. At this scale, attack surface management without systematic tooling is not operationally achievable.
- Fix NowOrg E — Email F: domain open to impersonation — No SPF, DKIM, or DMARC records detected. This temperature-controlled cargo operator sends high-value business communications — delivery confirmations, customs documentation requests, and freight invoices — over an unprotected mail domain. Any party in its supply chain can be targeted with a spoofed communication that bypasses email security controls.
- Fix SoonOrg C — 6 of 11 web applications rated F — This e-commerce fulfilment operator has a small but critically exposed web estate. With application risk D, SSL service risk D, and software risk D, Org C's public footprint presents a high-density concentration of serious issues on a limited number of targets — making it straightforward to prioritise for an attacker focused on this operator.
- Fix SoonSecurity headers missing from 4/5 organisations — Header risk is D at Orgs B, C, D, and E. Absent Content Security Policy, HSTS, X-Frame-Options, and similar controls leave logistics portals open to clickjacking attacks, cross-site scripting amplification, and information leakage — weaknesses that compound the damage potential of the software vulnerabilities already identified.
- Fix SoonOrg B — Three F-rated SSL services — Deprecated TLS configurations on externally reachable SSL services at this port logistics operator undermine the security of encrypted connections from carrier integrations and partner API traffic. Combined with Header D and Application risk C (6 F-rated apps), Org B presents a consistent pattern of web security underinvestment.
- MonitorAmazon Web Services concentration risk across 4/5 organisations — AWS infrastructure underpins logistics platforms at four of the five organisations scanned, with digital proximity reaching 62% at Org B. Shared cloud infrastructure dependency across a sector that operates critical supply chain nodes creates correlated disruption risk if AWS availability or security events occur.
See exactly where your logistics operation is exposed
ThingsRecon scans your external attack surface from the outside in — no agents, no credentials, no internal access required. Within hours you receive a full picture of your web estate, supply chain dependencies, and prioritised remediation roadmap.