Recent cyber attacks show supply chain trust is now the attack surface

At a glance

What this is: Secureframe’s review of recent cyber attacks says incident volume and losses are rising while adversaries increasingly exploit trusted tools, suppliers, OT systems, and telecom relationships.

Why it matters: IAM, PAM, NHI, and security teams should treat trust paths as attack paths, because access scope, third-party exposure, and recovery readiness now shape operational resilience.

By the numbers:

• Cyber attacks more than doubled in 2025, according to Secureframe.
• Health-ISAC’s 2025 Fourth Quarter Health Sector Heartbeat reported a 55% year-over-year increase in cyber incidents, according to Secureframe.
• US cybercrime losses hit nearly $21 billion in 2025, a 26% year-over-year increase, according to Secureframe.

Context

Recent cyber attacks now show a clear governance gap: organisations still think in terms of entry points, while attackers increasingly exploit the trust fabric that connects suppliers, tools, credentials, devices, and operational dependencies. In practice, that means a compromise can move through legitimate access paths faster than perimeter controls can react.

For IAM and NHI programmes, the important shift is that trust is no longer a background assumption. Third-party access, service credentials, and delegated relationships are now part of the attack surface, which makes lifecycle control, privilege scope, and monitoring central to resilience rather than support functions.

Key questions

Q: What breaks when trust relationships are not tightly governed in cyber environments?

A: When trust is not tightly governed, attackers can move through legitimate suppliers, tools, and credentials instead of forcing noisy perimeter intrusion. That turns normal access into a covert attack path for persistence, lateral movement, and downstream disruption. The failure is not only technical access. It is the assumption that trusted paths remain safe after one part of the relationship is compromised.

Q: Why do trusted tools and supplier access increase cyber risk so quickly?

A: Trusted tools and supplier access increase risk because they often carry broad permissions, implicit confidence, and access to production systems. If one credential, update channel, or support relationship is compromised, the attacker inherits that trust and can operate inside normal workflows. The result is faster escalation and harder detection than with direct external intrusion.

Q: What are the signs that supply chain access is becoming risky?

A: Warning signs include credentials present in source control, build systems that reuse long-lived tokens, and deployment paths that can reach production with little separation of duties. Those patterns show that the supply chain can be turned into an identity path, not just a software delivery path. The risk rises when one leaked secret can touch multiple environments.

Q: How should teams respond when OT or telecom systems are part of the attack surface?

A: Teams should separate operational assets from general enterprise access, limit remote administration to tightly governed paths, and assume recovery will be slower than in IT environments. OT and telecom systems need control designs that prioritise exposure reduction, segmentation, and validated containment because downtime constraints make after-the-fact cleanup more difficult.

Technical breakdown

Why trusted software and suppliers are ideal attack paths

Attackers increasingly favour trusted dependencies because security controls often grant them implicit access. When a supply chain component, update channel, or support account is compromised, the malicious activity inherits legitimacy from the relationship itself. That lets intruders bypass some detection logic, blend into normal admin or automation traffic, and spread impact across customers or environments that rely on the same component. The technical problem is not just code integrity. It is the downstream trust graph created by software distribution, vendor access, and shared operational tooling.

Practical implication: Model supplier and tooling trust as an attack path and constrain what any trusted dependency can reach.

How OT and telecom environments change the control problem

Operational technology and telecom networks are harder to protect with standard enterprise assumptions because uptime, legacy systems, and tightly coupled processes limit quick changes. Internet-facing devices, PLCs, and telecom backdoors can create long-lived footholds where attackers can disrupt operations, intercept communications, or pivot toward broader infrastructure targets. In these environments, identity and access controls still matter, but segmentation, remote access governance, and device exposure management become equally important. The technical failure is not simply exploitation. It is the combination of reachable systems, weak segmentation, and dependencies that were designed for availability first.

Practical implication: Prioritise exposure reduction and remote-access control for operational assets that cannot tolerate traditional hardening cycles.

Why credential theft turns a short breach into persistent access

Several incidents in the article show that once attackers obtain valid credentials, the boundary between compromise and normal access collapses. Stolen API keys, admin credentials, or service account secrets can be used to harvest more data, move laterally, or maintain access through trusted workflows. This is especially dangerous in cloud and CI/CD environments where credentials are embedded in automation and reused across systems. The key technical issue is not only secret leakage. It is the persistence of standing trust after the original compromise should have been terminated.

Practical implication: Use credential lifecycle controls that revoke standing trust quickly and limit the reach of every exposed secret.

Threat narrative

Attacker objective: The attacker seeks durable access through legitimate trust paths so disruption, theft, or sabotage can continue beyond the initial compromise.

1. Entry often begins through a trusted channel such as a compromised supplier, exposed internet-facing OT device, or a stolen credential embedded in automation.
2. Escalation follows when the attacker uses that legitimate foothold to expand into adjacent systems, harvest more credentials, or deploy backdoors for persistence.
3. Impact emerges as data theft, operational disruption, supply chain compromise, or long-term access to sensitive communications and mission-critical services.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trust relationships have become the real perimeter. The article’s strongest signal is that attackers are no longer satisfied with breaking in at the edge when they can abuse the access paths organisations already trust. That shifts governance from perimeter defence to trust-path governance across suppliers, automation, and operational dependencies. Practitioners should treat every legitimate relationship as a potential attack corridor.

Supply chain trust is a governance problem, not just a vendor problem. The recurring pattern across these incidents is not merely third-party involvement but weak control over what trusted parties, tools, and processes can do once admitted. That is where IAM, PAM, and NHI governance intersect with broader cyber resilience. If access scope, revocation, and monitoring are not enforced at the relationship level, the trust model itself becomes the vulnerability.

Standing privilege is the hidden multiplier in modern attacks. The article shows how a single exposed credential or over-extended trust relationship can create persistence, lateral movement, and delayed detection. This is especially relevant where service accounts, API keys, and automation credentials operate outside normal human access review cycles. Practitioners should read this as evidence that standing privilege reduction is now a resilience requirement, not an optimisation.

Attackers are selecting environments where change is hardest. OT, telecom, and critical infrastructure systems are attractive because operational constraints slow remediation and widen the useful life of attacker access. That means control design has to account for legacy systems, limited downtime windows, and interdependent services. The right governance question is no longer whether an environment is connected, but how much damage its trust relationships can absorb before operations fail.

Identity security posture management is the common control theme. Across cloud, supply chain, and operational incidents, the same failure pattern appears: organisations cannot confidently answer who or what has access, for how long, and through which dependencies. That is a posture management problem as much as a detection problem. Teams should measure trust exposure continuously, because a static access review cannot keep pace with dynamic supply chain and machine identity risk.

What this signals

Identity Security Posture Management becomes the practical response when trust relationships outgrow manual review. The article shows why traditional access checks miss the real issue: supplier access, service credentials, and automation paths change faster than periodic governance can track. Teams need continuous visibility into who and what can reach production, especially when access is delegated across vendors and workloads.

Attack surface management now has to include machine identity and supplier trust. In environments built around cloud delivery and operational dependencies, the meaningful question is not just whether a system is exposed, but whether a trusted path can be abused after compromise. That makes access scope, revocation discipline, and dependency mapping central to resilience planning.

For practitioners

• Inventory external trust relationships Map third-party integrations, support accounts, automation paths, and operational dependencies so you know which trusted connections can reach sensitive systems.
• Reduce standing credential exposure Shorten the lifetime and scope of service account secrets, API keys, and admin credentials used in CI/CD, vendor access, and infrastructure automation.
• Segment operational and critical systems Separate OT, telecom, and production environments from general enterprise access paths and restrict remote administration to tightly governed channels.
• Tighten supplier and tool offboarding Remove dormant vendor accounts, revoke unused tokens, and validate that access removal propagates across connected tools and workflows.
• Test incident containment across dependencies Exercise recovery plans against supply chain compromise, credential theft, and OT disruption scenarios so restoration works even when trusted tools are unavailable.

Key takeaways

• The article’s core message is that cyber risk is shifting from perimeter intrusion to abuse of legitimate trust paths across suppliers, tools, and operational systems.
• Recent incidents show that once a trusted dependency, credential, or update channel is compromised, attackers can persist, move laterally, and disrupt operations at scale.
• Teams need continuous visibility into access scope and dependency trust, because static reviews cannot keep pace with modern supply chain and machine identity risk.

Key terms

• Trust Relationship: A configured connection in which one identity, system, or vendor is allowed to rely on another without repeating full verification every time. Trust relationships are efficient, but they become risky when they outlive the business need or grant broader access than the original purpose justified.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Supply Chain Attack Surface: The supply chain attack surface is the collection of systems, identities, and workflows an attacker can target to alter software before it reaches users. In developer environments, it includes laptops, source control credentials, package manager tokens, and build pathways, all of which can be abused to spread malicious code through trusted channels.
• Identity Security Posture Management: Identity security posture management is the continuous assessment of identity configuration, privilege, and exposure across an environment. It focuses on drift, overprivilege, and control gaps so teams can see where IAM, PAM, and NHI governance are failing before those gaps become incidents.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to govern service accounts, secrets, and delegated access across modern security programmes.