A business today functions as a complex ecosystem in which every participant influences the results, the reputation and, more importantly, the sustainability of the wider organisation.
Every business sits inside a vast network of partners, suppliers and service providers whose actions ripple across industries.
Resilience therefore depends not only on internal protection measures but on the strength and security of those external connections. As technology ecosystems grow more complex, protecting a supply chain means accepting that risk can emerge from any link – including the ones furthest from view.
According to a recent global study by Kaspersky’s internal market research centre, supply chain attacks ranked as the top threat companies faced in 2025. Large enterprises were especially vulnerable, given their extensive networks of contractors and third-party vendors.
Business leaders, chief information security officers, information security managers and procurement executives now need not only to grasp the risks these attacks pose but to deploy protective measures that mitigate them.
The key to managing this chain of interactions is an ecosystem approach: a model in which an organisation treats its own security and that of its contractors and partners as a single, interconnected system.
Frontline defence: pre-contract control
Rather than treating supplier risk as secondary, the approach assumes that a vulnerability anywhere in the chain can directly affect the organisation itself. It requires unified standards, shared responsibilities and coordinated controls across every stakeholder, and it covers the full lifecycle of cooperation – before a partnership begins, during collaboration and after a contract ends.
Start by building an internal system of security requirements for suppliers and contractors that governs how they are assessed, approved and managed. Establish policies covering supplier onboarding, data processing, access rights and the minimum baseline every third party must meet. Compliance with globally recognised standards such as ISO 27001 or SOC 2 can be made a condition of admission to tenders.
Simple open-source intelligence techniques will reveal whether a coordinated vulnerability disclosure programme, a history of published vulnerabilities and a bug bounty programme are in place. How quickly a vendor resolves issues reveals how seriously it treats product security. Starting with internal standards and rigorous verification ensures that every supplier enters the ecosystem at a verified level of maturity.
Further action items on verifying the security of partners are set out in a dedicated checklist prepared by Kaspersky experts.
Another indispensable practice is embedding IT security requirements into supplier contracts. According to Kaspersky’s report, only 37% of businesses do this. Setting expectations in writing gives companies predictable control over how third parties handle sensitive information, manage vulnerabilities and respond to incidents.
Data privacy clauses oblige suppliers to protect corporate information and customer data, preventing unauthorised disclosure or misuse. Technical standards mandate encryption, two-factor authentication, secure coding practices and regular software updates, all of which reduce the likelihood of exploitation through outdated or vulnerable systems. Clear incident response rules specify how quickly a contractor must report a breach and what it must do to support investigation and containment.
For critical environments, it is also essential to request a source code review. Code offers the deepest visibility into how a product actually behaves and where hidden risks may sit. Examining it directly – particularly the components handling authentication, data processing and communication – gives technical specialists assurance that the product is trustworthy at its core.
Trust, but verify: collaborating with confidence
Once those first checks are complete and a supplier’s conformity with the security criteria is confirmed, attention shifts to the risks that emerge once work begins. Suppliers may run outdated software, depend on vulnerable third-party tools of their own, or employ staff whose credentials have been compromised. Their systems may be targeted precisely because they offer an indirect path into your environment.
Step two is therefore continuous, advanced infrastructure monitoring through extended detection and response (XDR) or endpoint detection and response (EDR). It detects unauthorised access and exploitation attempts early, narrowing the window available to attackers. It also allows organisations to correlate threat intelligence with real activity inside their environment, so that emerging vulnerabilities or relevant threat campaigns are identified before they escalate. Advanced monitoring turns supply chain security from a series of one-off checks into a dynamic defence layer that protects the ecosystem throughout the lifecycle of cooperation.
To confirm that long-term partners maintain a consistently strong security posture, organisations should also run at least one comprehensive audit a year. These reviews should include compliance checks and technical assessments such as penetration testing and simulated attack scenarios originating from the supplier’s network.
Before any vendor update is deployed into production, it should be run in a controlled, isolated sandbox to check for abnormal behaviour and compatibility with the software environment. Pre-deployment testing prevents compromised or poorly implemented updates from reaching critical systems.
Organisations must also take a systematic approach to cyber education, assessing the team’s cyber literacy regularly and running training to close the gaps. Resources should go not only to training internal staff but to improving the security proficiency of partners. Joint workshops build a common language around risk and reduce the probability of attacks that exploit the human factor on either side. Gamified security competitions such as capture-the-flag challenges let teams practise attack and defence techniques safely.
Offboarding without blind spots
Ending a supplier relationship is a high-risk moment in the supply chain lifecycle, which is why organisations need structured offboarding processes that eliminate access and protect sensitive data.
First, revoke all digital access and dismantle system integrations so that former contractors cannot remain connected to internal infrastructure. That means disabling accounts, API keys, single sign-on links and VPN profiles, and removing any cloud resources they deployed.
Second, secure and retrieve all data, verifying that the supplier has deleted corporate information, returned intellectual property and given up any future access to confidential or personal data. Formal destruction certificates and strict data minimisation practices help prevent unauthorised retention or misuse once the relationship ends. Together these measures close every remaining entry point and ensure a clean disengagement that leaves no lingering vulnerabilities.
At a time when supply chain weaknesses regularly surface in global news, proactive preparation is a fundamental requirement rather than an optional extra. Organisations that engage thoroughly with suppliers at every stage, formalise contractual expectations and invest in the security of their partners do not merely embed resilience into their operations – they gain a competitive advantage.
- The author, Sergey Soldatov, is head of the security operations centre at Kaspersky
- Read more articles by Kaspersky on TechCentral
- This promoted content was paid for by the party concerned
