Seven in ten cybersecurity professionals say supply chain cyber risk is now a major concern for their organizations, highlighting how deeply digital exposure has spread across vendor and partner networks. New global survey data from ISC2 shows that many companies still lack clear insight into the security posture of third parties, and that blind spot is becoming one of the most persistent vulnerabilities in modern supply chains.
Concern Rises Sharply in Large and Regulated Sectors
The survey, which included 1,062 cybersecurity professionals worldwide, found that 70% of respondents are highly concerned about supply chain cyber risk overall. Anxiety is even more pronounced in larger and more regulated environments. Among enterprise organizations, concern rises to 82%, while 81% of respondents in the military and defense contracting sectors report elevated worry. Healthcare organizations are not far behind, with 67% indicating high levels of concern.
Across industries, visibility into third-party practices emerged as the dominant issue. Many respondents said they have limited insight not only into direct vendors, but also into suppliers further upstream. One participant described the situation as a case of “trust but can’t verify,” capturing a common tension between commercial reliance and security assurance.
That lack of transparency carries measurable consequences. Twenty-eight percent of organizations said they experienced a cybersecurity incident involving a third-party supplier in the past two years. The exposure is higher among large enterprises, where 34% reported such incidents, and highest in financial services, where the figure reached 37%.
Not every incident resulted in direct customer harm. Nearly half of respondents, 47%, said supplier-related breaches caused no major operational or customer impact. Even so, many described these events as near misses that heightened awareness of how quickly vendor-side weaknesses can cascade into broader risk.
Breaches, Malware, and Weak Controls Top the Risk List
When asked what worries them most about supply chain cyber exposure, respondents pointed first to data breaches, cited by 64%. Malware and ransomware followed at 52%, closely trailed by software vulnerabilities embedded in supplier products, at 51%. Unauthorized access using third-party credentials was also a significant concern, flagged by 37% of participants.
Beyond these established risks, respondents pointed to emerging pressure points. Insider threats originating within vendor organizations remain difficult to detect, while the growing use of AI tools by suppliers raises new questions about governance, data handling, and control maturity when safeguards are inconsistent or poorly enforced.
Organizations are responding with a mix of formal standards and tighter controls. Most respondents said they conduct supplier risk assessments at least annually, and 77% now require vendors to comply with recognized frameworks such as ISO 27001, NIST, or SOC 2. Many are also strengthening onboarding requirements, expanding security audits, mandating multi-factor authentication, and tightening incident notification timelines.
Yet the survey also highlights uneven maturity. Ten percent of organizations said they still have no formal supply chain cyber risk program in place, with some acknowledging they are only now beginning to build one.
When Cyber Risk Shapes Access to the Network
Cybersecurity expectations are increasingly embedded into how supplier relationships are structured and maintained. Large enterprises and public-sector buyers are expanding continuous monitoring, audit rights, and incident disclosure requirements beyond Tier 1 partners, reflecting a recognition that cyber exposure travels through operational dependencies, not contractual boundaries. As these practices become standardized, suppliers with weaker security controls face longer onboarding cycles, restricted system access, or exclusion from sensitive programs altogether, making cyber maturity a practical condition of participation rather than a secondary compliance exercise.
