SecurityScorecard Q2 2025 coverage highlights supply chain risk

At a glance

What this is: SecurityScorecard’s Q2 2025 press coverage highlights how supply chain risk, third-party breaches, and the LapDogs ORB campaign point to persistent footholds built through exposed routers and IoT devices.

Why it matters: IAM, NHI, and security teams need to treat supplier trust, device trust, and credential governance as one control surface because third-party exposure can become an entry path for persistence and espionage.

Context

Supply chain cyber risk is what happens when organisations inherit trust they do not fully control. In practice, that means third-party access, device exposure, and delegated credentials can become part of the attack surface even when the primary compromise starts elsewhere. This article is primarily about that governance gap, with a clear identity angle where non-human identities, supplier access, and machine trust intersect.

SecurityScorecard’s Q2 2025 coverage also shows why this problem now sits across security domains rather than inside a single control family. The LapDogs reporting, the third-party breach coverage, and the commentary on AI-enabled attacks all point to the same operational issue: organisations need to govern who and what can act on their behalf across suppliers, services, and connected devices.

Key questions

Q: What breaks when third-party access is not tightly governed in supply chain environments?

A: The trust relationship itself becomes the attack path. If vendor credentials, service accounts, or API tokens can reach too many systems, a compromise in one supplier can cascade into production access, data exposure, and lateral movement across connected environments. The control failure is usually not a firewall issue. It is weak entitlement scope, missing ownership, and poor offboarding.

Q: Why do routers and IoT devices matter so much in ORB campaigns?

A: Routers and IoT devices are attractive because they sit at the edge, are widely distributed, and are often weakly monitored. When attackers convert them into relay infrastructure, they gain resilient transport paths that are harder to block than a single command-and-control server. That makes edge-device hygiene part of espionage defence.

Q: How should security teams measure whether supplier risk monitoring is actually working?

A: Look for evidence that monitoring changes decisions. Effective programmes reduce the time between a new supplier issue and an access or remediation action, and they can show which identities, systems, and relationships were affected. If risk scores are generated but never drive segmentation, revalidation, or ticketed response, the monitoring is informational rather than operational.

Q: Should organisations treat AI-enabled attacks as a separate risk category from supply chain security?

A: No. AI-enabled attacks often act as an accelerator for existing supply chain problems rather than a separate class of risk. The right approach is to update supplier-risk scenarios for faster reconnaissance, automation, and abuse, then feed those assumptions into identity governance, detection, and response planning.

Technical breakdown

How ORB networks create persistent footholds

ORB, or operational relay box, networks use compromised routers, IoT devices, and similar edge systems as relay infrastructure. That makes attribution and blocking harder because traffic can appear to originate from ordinary consumer or small-office devices rather than from a fixed attacker server. In the LapDogs reporting referenced here, the important mechanism is persistence through distributed infrastructure, not a one-time exploit. Once enough relays exist, the attacker can rotate paths, blend into normal traffic, and keep access alive across regions.

Practical implication: inventory and monitor exposed edge devices as part of your attack surface, not just your internal estate.

Why third-party access expands the identity boundary

Third-party risk becomes an identity problem when suppliers receive persistent access, reused credentials, or trust that outlives the business need. A supplier compromise can then propagate through accounts, tokens, API connections, or device management paths that were never built for continuous review. The article’s supply chain focus is a reminder that external trust relationships behave like standing privileges unless they are time-bound, scoped, and actively revoked. That is especially true when service accounts and machine access sit behind procurement rather than IAM governance.

Practical implication: treat supplier connectivity, shared secrets, and delegated service access as governed identities with lifecycle controls.

How AI-enabled attacks change supply chain risk assessment

AI-enabled attacks do not replace classic supply chain compromise, but they can increase scale, speed, and variation in the attacker’s tradecraft. That matters because defenders often separate technical compromise from trust abuse, while AI-assisted campaigns can combine reconnaissance, targeting, and infrastructure abuse more efficiently. The governance issue is not whether AI is the root cause of every incident. It is that the attacker’s ability to search, adapt, and automate now compresses the time between exposed dependency and exploitable trust relationship.

Practical implication: update supplier monitoring and threat models to account for faster discovery of exposed paths and more adaptive abuse patterns.

Threat narrative

Attacker objective: The objective is to maintain resilient espionage infrastructure that can support long-term access and surveillance across multiple geographies.

1. Entry occurs through routers and IoT devices that are turned into relay infrastructure for the LapDogs ORB campaign.
2. Credential and trust abuse follow when the attacker leverages distributed relays and third-party exposure to maintain access without a single fixed foothold.
3. Impact comes from persistent espionage infrastructure that spans regions and makes detection, attribution, and containment materially harder.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Supply chain cyber risk is now an identity governance problem as much as a vendor assurance problem. The article’s core pattern is not just third-party weakness but the way trust is extended through credentials, device access, and service relationships. That makes non-human identity governance part of supply chain resilience, not a separate hygiene exercise. Practitioners should govern external access with the same lifecycle discipline they expect for internal privileged access.

Persistent relay infrastructure changes the meaning of exposure. ORB networks show that compromise does not need to end at initial access. If routers and IoT devices can be turned into distributed relays, then exposure persists even after individual nodes are remediated because the operator can rebuild the path. The field should treat distributed edge trust as a standing risk condition, not a one-off incident category.

Third-party breaches are increasingly a control inheritance issue. The organisation owning the relationship often inherits the consequences of credentials, integrations, and connected services it does not directly operate. This is where governance assumptions fail: reviews assume suppliers remain stable, but attacker tradecraft now exploits the gap between onboarding, monitoring, and offboarding. Teams need supplier lifecycle controls that match the blast radius of delegated access.

AI-enabled attack commentary matters because it compresses the attacker’s operating tempo. Even when AI is not the cause of the initial compromise, it can improve targeting, automation, and variation across the supply chain. That raises the bar for detection latency and makes static trust assumptions less viable. Practitioners should assume faster attacker adaptation and build response models around continuous validation, not periodic review.

Supply chain security debt is the right named concept for this coverage. The article shows how unmanaged supplier relationships, exposed devices, and stale trust accumulate into a risk balance that eventually gets paid by the defender. That debt grows when access is granted faster than it is verified or removed. Practitioners should reduce the debt by shrinking long-lived trust paths and tightening control over delegated access.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Supply chain security debt: when suppliers, devices, and machine access accumulate faster than organisations can verify and revoke them, the result is a growing pool of inherited trust that adversaries can keep reusing. Teams should expect that debt to show up first in third-party access reviews, unmanaged edge devices, and stale service credentials, not just in headline breaches.

The practical response is to collapse the distance between onboarding and offboarding for suppliers and automation alike. Where access cannot be continuously validated, it should be scoped down, time-bound, or removed before it becomes a persistent path into production.

For practitioners

• Tighten third-party identity lifecycle controls Map every supplier account, token, certificate, and integration to an owner, purpose, expiry, and revocation path. Revalidate access on a fixed cadence and remove standing access that no longer has a business justification.
• Inventory edge devices that can become relays Identify internet-facing routers, SOHO gear, and IoT devices that could be repurposed for relay infrastructure. Prioritise exposure reduction, segmentation, and firmware control for assets that sit outside standard server monitoring.
• Extend supplier monitoring beyond contract events Monitor behavioural signals from third-party access, including unusual geography, timing, and authentication patterns. Treat continuous monitoring as a control requirement rather than a procurement artifact.
• Reassess trust boundaries for machine identities Classify machine identities used by suppliers and automation systems as governed identities with explicit scope and offboarding. Revoke stale credentials and reduce reuse across environments.
• Update threat models for AI-assisted supply chain abuse Add faster reconnaissance, adaptive phishing, and automated infrastructure replacement to supplier-risk scenarios. Use those assumptions to shorten detection and containment thresholds.

Key takeaways

• The article points to a single control failure pattern: organisations still manage supplier trust, device exposure, and machine access as separate problems when attackers use them together.
• SecurityScorecard’s Q2 2025 coverage ties that pattern to persistent ORB footholds, third-party breach pressure, and AI-assisted escalation across regions.
• The most useful defensive change is to treat external access as a governed lifecycle, not a permanent relationship, and to remove the unused paths that create long-lived exposure.

Key terms

• Operational Relay Box: A compromised device that attackers repurpose as covert infrastructure for routing, hiding, or sustaining access. The device may not be the final target, but it becomes part of the attacker’s control plane and can support espionage, command traffic, or lateral access.
• Third-Party Access Lifecycle: Third-party access lifecycle is the full sequence of granting, using, reviewing, and removing external access to internal systems. It matters because supplier credentials and remote sessions often outlive the business need, creating governance gaps that are difficult to detect without explicit offboarding and review.
• Supply Chain Security Debt: Supply chain security debt is the accumulated risk created when supplier trust, access paths, and connected devices are added faster than they are verified, monitored, and removed. It is a useful way to describe why minor gaps in third-party governance eventually produce major compromise paths.
• Machine Identity Governance: Machine Identity Governance is the discipline of controlling how non-human identities are created, used, monitored, and retired. It covers service accounts, API keys, certificates, tokens, workloads, and automation identities, with policies for ownership, lifecycle, least privilege, rotation, attestation, and auditability across cloud, application, and infrastructure environments.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It suits practitioners who need to connect machine identity controls to wider security governance.