A new ISC2 survey shows rising anxiety over weak visibility into third-party vendors, with large companies and service providers feeling the most exposed. The research shows that 70% of surveyed organizations are highly concerned about cybersecurity risks stemming from their supply chains. Among large enterprises, that figure rises to 82%, reflecting the growing attack surface created by complex service relationships, cloud reliance, and software dependencies.
According to the survey, small and midsize companies express materially lower but still significant levels of concern at 57%. Recent industry reporting supports this divide: larger organizations tend to manage a wider network of digital partners and applications, creating more potential entry points and raising the likelihood of cascading impact when a supplier is compromised.
Heightened Exposure for Service Providers and High-Value Sectors
Organizations delivering software, digital services, or managed solutions to customers report notably higher anxiety, with 72% indicating they are very or extremely concerned, compared with 65% among organizations that do not operate in these categories. ISC2 notes that this pattern reflects the inherent responsibility these firms carry, as any supplier-side vulnerability risks propagating rapidly across their client base.
The financial sector shows the highest levels of unease. Eighty-two percent of financial services respondents report being very or extremely concerned, and 37% say they experienced a vendor-originating cyber incident within the past two years. That rate is significantly higher than in industries such as IT services, where only 20% report a similar event.
Overall, 28% of all surveyed organizations have suffered a cybersecurity incident tied to a third-party vendor or supplier over the past two years. The probability of impact rises with scale: 34% of enterprise respondents report such incidents. Notably, 75% of organizations that have already experienced a supply chain breach are highly concerned about future exposure, significantly more than the 63% among those without prior incidents.
Data breaches remain the most disruptive threat (cited by 64% of respondents), followed by ransomware and malware (52%) and software vulnerabilities embedded in supplier products (51%). Insider risk is not far behind: 29% identify vendor-side insider threats as disruptive, reflecting the persistent challenge of credential sprawl and access governance.
Visibility Gaps Persist Even as Risk Programs Mature
The dominant operational challenge cited by respondents is a lack of visibility, transparency, or control over their suppliers, an issue consistent with broader industry assessments from leading cybersecurity firms. With many companies reliant on multi-tiered supply chains, organizations often struggle to understand not only the practices of direct vendors but also the cybersecurity maturity of downstream partners.
Despite this gap, most organizations are attempting to formalize oversight. Seventy percent conduct third-party risk assessments on a scheduled basis, typically during contract renewal or annually. Nearly half also carry out assessments during onboarding. Yet evaluation frequency varies widely: 45% assess suppliers annually, 17% do so quarterly, and 12% monthly. Nine percent admit they only evaluate vendors during initial onboarding—a single point-in-time assessment that leaves long stretches of blind spots.
Compliance frameworks remain the primary control lever. Seventy-seven percent of organizations require adherence to standards such as ISO 27001, NIST, or SOC 2; 71% require external audits or attestations; and 62% mandate multi-factor authentication and secure access protocols. About 61% require formalized incident response and breach notification processes. Only 5% report having no cybersecurity requirements for suppliers.
More than half (54%) of organizations now maintain a dedicated supply chain risk management program, rising to 70% among large enterprises. Meanwhile, 10% acknowledge having no formal program in place, though 8% say they are currently developing one.
Why Continuous Insight Will Matter More Than Annual Checks
One overlooked shift is that supply chain security is increasingly shaped by how quickly organizations detect change, not how thoroughly they audit once a year. Recent reporting around high-profile compromises, from software update tampering to identity misuse at trusted vendors, shows that attackers often exploit moments when suppliers alter systems, add integrations or onboard new subcontractors. The companies that adapt fastest will be those that treat third-party intelligence as a living input to operations, updating permissions, dependencies, and trust levels as conditions evolve. As vendor ecosystems continue to expand, the advantage will sit with organizations that can turn visibility from a periodic exercise into an ongoing source of risk awareness.
