Supply chain attacks expose business continuity gaps in PAM controls

At a glance

What this is: A supply chain attack analysis showing how trusted vendors, build pipelines, and third-party access can turn one compromise into enterprise-wide disruption.

Why it matters: IAM, PAM, and NHI teams need to treat supplier trust paths as identity risk, because a compromise outside the core environment can still trigger privileged lateral movement and prolonged operational impact.

By the numbers:

• According to The Cost of a Data Breach Report 2025, it takes an average of 267 days to identify and contain a supply chain attack.
• The breach brought global operations to a standstill for five weeks and impacted over 5,000 suppliers.
• The direct costs related to the cyber incident soared to £196 million, while revenues plummeted by nearly 25%.

👉 Read Fudo Security's analysis of why supply chain attacks threaten business continuity

Context

Supply chain attacks exploit trust between an organisation and the external parties it depends on. In identity terms, that means the weak point is often not the core perimeter but the vendor account, library dependency, build pipeline, or remote access path that already has legitimacy inside the workflow.

For IAM, PAM, and NHI programmes, this changes the security question from who is inside the network to which identities and delivery channels are trusted to act on the organisation's behalf. Once those relationships are abused, business continuity becomes an identity governance problem as much as a resilience problem.

Key questions

Q: How should security teams reduce supply chain risk in privileged access workflows?

A: Security teams should treat every supplier, maintainer, and remote support path as a controlled identity relationship. That means limiting standing access, enforcing just-in-time privilege, recording sessions, and revoking access when the task ends. The goal is to keep a trusted third party from becoming a persistent attack path across production systems.

Q: Why do supply chain attacks create such large business continuity impacts?

A: They use trusted channels to spread compromise across multiple systems and organisations at once. A single poisoned dependency, compromised maintainer account, or vendor update can affect software delivery, remote administration, and downstream operations. That makes the blast radius far larger than a normal endpoint or perimeter intrusion.

Q: What breaks when vendor access is broad and persistent?

A: When vendor access is broad and persistent, a single compromised external identity can move laterally, modify production inputs, or maintain access long after the original task should have ended. The failure is not only technical exposure, but governance drift. Access that outlives accountability becomes an outage multiplier.

Q: Who is accountable when a supplier compromise disrupts operations?

A: Accountability is shared, but the owning organisation remains responsible for governing third-party access, pipeline trust, and continuity planning. Frameworks such as Zero Trust and PAM expect the business to control what external identities can do, even when the supplier operates the system. Delegated trust does not delegate responsibility.

Technical breakdown

How trusted delivery channels become the entry point

Supply chain attacks rarely need a dramatic perimeter break. Attackers compromise a maintainer account, dependency, update path, or vendor site, then use that trusted channel to deliver malicious code or access. Because the request looks legitimate, controls that rely on destination trust, package reputation, or routine approval can be bypassed before detection has time to catch up. In the Axios case described by the vendor, a social engineering compromise of a maintainer account enabled malicious dependency insertion, which is a classic trust-channel abuse pattern. The core issue is that the organisation inherits trust from upstream parties it does not directly control.

Practical implication: Treat upstream delivery paths as privileged entry points and apply identity scrutiny to maintainers, package sources, and vendor update channels.

Why build pipelines and CI/CD checks can be bypassed

Modern supply chain attacks often target the software factory rather than the production environment. If an attacker can alter package definitions, poison a build step, or tamper with the artefact source, the malicious payload can be produced as if it were legitimate software. CI/CD checks help only when the pipeline assumptions still hold. Once the attacker changes the input, the pipeline can faithfully deliver the compromise at scale. That is why dependency confusion, build tampering, and malicious package injection remain effective: they weaponise the same automation that makes software delivery efficient.

Practical implication: Harden build provenance, validate dependencies, and reduce the number of identities that can modify release inputs.

How third-party privileged access turns compromise into outage

When a supplier identity has broad or persistent access, the impact of a single compromise expands quickly. PAM matters here because the attacker does not need permanent network control if they can abuse an approved remote session, escalate privileges, or move laterally through systems the supplier is trusted to manage. Fudo Security's article ties this to business continuity by showing how one compromise can cascade across suppliers, operations, and revenue. The technical pattern is not only initial access, but trust amplification through legitimate access paths that were never intended to absorb hostile behaviour.

Practical implication: Constrain supplier access with just-in-time privilege, session control, and explicit offboarding of external identities.

Threat narrative

Attacker objective: The attacker wants to convert a single trusted dependency or supplier identity into broad operational disruption and long-dwell access across multiple organisations.

1. Entry occurs through a trusted third-party channel such as a compromised maintainer account, poisoned dependency, or vendor-managed update path.
2. Escalation follows when the malicious package, payload, or remote session inherits legitimate trust and bypasses routine CI/CD or access checks.
3. Impact is achieved through lateral movement, operational disruption, data exposure, or extended recovery time across the supplier ecosystem.

Breaches seen in the wild

• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted supplier access is an identity issue, not just a procurement issue. Once a vendor, maintainer, or external service is granted operational trust, the organisation inherits their identity risk as part of its own control plane. That means compromise can occur without any direct breach of the core environment, yet still create internal privilege abuse and continuity loss. Practitioners should treat third-party identities as first-class governance objects, not as background dependencies.

Supply chain resilience now depends on controlling the blast radius of legitimate access. The article shows that attacks succeed when trusted pathways are broad enough to let a single compromise spread across pipelines, systems, and suppliers. PAM, Zero Trust, and lifecycle controls matter here because they reduce how far an attacker can travel once one identity is abused. The practical conclusion is that continuity planning must be built around access containment, not only detection.

Dependency trust is a named concept: upstream legitimacy can become downstream liability. This is the failure mode behind dependency confusion, poisoned builds, and malicious update delivery. The problem is not merely that code is untrusted, but that trusted channels are being used as the attack vehicle. Organisations should review which identities and artefact sources are allowed to write into production paths, because provenance is now part of access governance.

Business continuity metrics should include identity exposure and supplier privilege scope. The Jaguar Land Rover example makes clear that the operational cost of supply chain compromise is measured in downtime, supplier disruption, and revenue loss, not only incident response hours. Governance programmes that stop at internal assets miss the wider ecosystem where trust is actually consumed. Practitioners should measure how much of their continuity risk sits in external identity relationships.

OWASP-NHI style controls are now relevant to software supply chains even when the breach is not 'about NHI' in the narrow sense. Trusted machine access, API keys, maintainer accounts, and build credentials are the access layer that makes supply chain compromise persistent. The article reinforces that identity hygiene for external and machine actors is part of resilience engineering. Security teams should review supplier identities with the same discipline they apply to internal privileged accounts.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
• If secrets exposure is already slow to remediate, the next step is reducing who can use them in the first place, which is why 52 NHI Breaches Analysis is the natural forward read for supplier-access governance.

What this signals

Supply chain resilience is moving toward identity-centric containment, because organisations cannot assume they will detect every compromised dependency or maintainer quickly enough to prevent impact. The operational question is no longer whether trust relationships exist, but how tightly those relationships are scoped, monitored, and expired before they can be abused.

Identity blast radius: the practical measure of how far a compromised supplier, maintainer, or service account can move before controls stop it. That concept now matters as much in software delivery as in remote access, especially when third-party relationships feed production systems and business-critical workflows.

For teams maturing PAM and NHI governance, the programme signal is clear: supplier access must be treated as a continuous risk surface, not a one-time onboarding event. The more external identities can write, deploy, or administer, the more continuity risk shifts from cyber hygiene into governance design.

For practitioners

• Map supplier trust paths to privileged access paths Inventory every external maintainer account, vendor-managed session, build credential, and package source that can influence production systems. Classify each by business criticality, then remove broad standing access where the supplier only needs task-scoped entry.
• Reduce CI/CD write authority to the smallest viable set Limit who can alter package definitions, build inputs, release artefacts, and dependency manifests. Require second-party approval for high-risk pipeline changes and log every modification to provenance-critical files.
• Apply just-in-time controls to third-party administrative access Use temporary elevation for external support, managed service, and integration accounts. Tie approvals to a named task, time box, and session recording so a compromised supplier identity cannot retain broad access after the work is done.
• Test continuity plans against supplier compromise scenarios Run exercises that assume a trusted vendor, package maintainer, or remote management path has been abused. Validate whether you can isolate that path quickly, preserve operations, and revoke external access without cascading outages.

Key takeaways

• Supply chain attacks are continuity failures because they exploit trusted identity and delivery paths, not just technical vulnerabilities.
• The impact can be severe and prolonged, with weeks of disruption, hundreds of millions in cost, and recovery timelines that outlast normal incident response assumptions.
• Teams should narrow third-party privilege, harden pipeline provenance, and treat supplier access as a governed identity relationship with a defined exit.

Key terms

• Supply Chain Attack: An attack that compromises a trusted third party, software dependency, or delivery path so the victim inherits malicious code, access, or content through a legitimate channel. In identity terms, the trust relationship itself becomes the entry point, which makes containment depend on governance of external access and artefact provenance.
• Third-Party Privileged Access: Access granted to a supplier, contractor, or managed service provider to perform operational work inside an environment. It often persists longer than it should and becomes risky when it is broad, unmonitored, or not tied to a specific task, because compromised external identities can move through trusted systems.
• Build Pipeline Poisoning: A compromise pattern where an attacker alters source inputs, dependencies, or build steps so the software delivery process produces malicious artefacts that appear legitimate. The weakness is not only in the code, but in the trust placed on the pipeline and the identities that can modify it.

What's in the full article

Fudo Security's full article covers the operational detail this post intentionally leaves for the source:

• A step-by-step walk through of the Axios dependency confusion scenario and the maintainer compromise path
• The vendor's comparison of SolarWinds, MOVEit, and modern build-pipeline poisoning tactics
• Specific controls used in Fudo Enterprise 6.0, including credential injection and reverse SSH
• Product examples for PAM and third-party access that are beyond the scope of this independent analysis

👉 Fudo Security's full article covers the Axios incident, PAM controls, and the continuity impact in more operational detail.

Deepen your knowledge

NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.