Topic starter
11/07/2026 8:23 pm
TL;DR: Recurring pressure points in supply chain cyber risk, third-party breaches, AI-enabled attacks, and the LapDogs ORB campaign used routers and IoT devices to establish persistent espionage footholds across multiple regions, according to SecurityScorecard’s Q2 2025 coverage. The lesson for security and identity teams is that exposed suppliers, unmanaged device trust, and weak credential governance now interact as one risk surface.
Editorial analysis by NHI Mgmt Group, based on content published by SecurityScorecard: “SecurityScorecard In The News Q2 2025”.
Key questions
Q: What breaks when third-party access is not tightly governed in supply chain environments?
A: The trust relationship itself becomes the attack path.
Q: Why do routers and IoT devices matter so much in ORB campaigns?
A: Routers and IoT devices are attractive because they sit at the edge, are widely distributed, and are often weakly monitored.
Q: How should security teams measure whether supplier risk monitoring is actually working?
A: Look for evidence that monitoring changes decisions.
Practitioner guidance
- Tighten third-party identity lifecycle controls Map every supplier account, token, certificate, and integration to an owner, purpose, expiry, and revocation path.
- Inventory edge devices that can become relays Identify internet-facing routers, SOHO gear, and IoT devices that could be repurposed for relay infrastructure.
- Extend supplier monitoring beyond contract events Monitor behavioural signals from third-party access, including unusual geography, timing, and authentication patterns.
Bottom line: The article points to a single control failure pattern: organisations still manage supplier trust, device exposure, and machine access as separate problems when attackers use them together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:53 pm
Supply chain cyber risk is now an identity governance problem as much as a vendor assurance problem. The article’s core pattern is not just third-party weakness but the way trust is extended through credentials, device access, and service relationships. That makes non-human identity governance part of supply chain resilience, not a separate hygiene exercise. Practitioners should govern external access with the same lifecycle discipline they expect for internal privileged access.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: No. AI-enabled attacks often act as an accelerator for existing supply chain problems rather than a separate class of risk. The right approach is to update supplier-risk scenarios for faster reconnaissance, automation, and abuse, then feed those assumptions into identity governance, detection, and response planning.
👉 Read our full editorial: SecurityScorecard Q2 2025 coverage highlights supply chain risk