Supply chain incident response: what do teams need to change first?

TL;DR: Supply chain incident response usually starts after the attacker has already moved, according to Black Kite, with Mandiant reporting exploitation seven days before disclosure, Black Kite Research Group tracking a 22-second handoff to ransomware operators, and a 117-day average breach notification delay. The right response model starts with business loss, not alerts, because speed only matters when the plan is built around what the organisation cannot afford to lose.

Editorial analysis by NHI Mgmt Group, based on content published by Black Kite: “Supply Chain Incident Response Starts Before the Incident”.

By the numbers:

• Mandiant's M-Trends 2026 report found attackers exploiting vulnerabilities an average of seven days before public disclosure.
• Black Kite Research Group tracked a 22-second handoff from vendor break-in to ransomware monetisation.
• Black Kite's 2026 Third-Party Breach Report found an average delay of 117 days before organisations know a vendor has been breached.

Key questions

Q: What breaks when supply chain incident response starts after detection?

A: The response model breaks because the attacker has already used the time between compromise and detection to move, monetise, or pivot.

Q: When should organisations prioritise supplier risk over generic threat intelligence?

A: Prioritise supplier risk whenever the vendor can touch critical data, workflows, or identity paths.

Q: How can organisations know whether third-party incident response is actually working?

A: Measure how quickly teams can identify the impacted vendor, revoke reachable access, and confirm that secrets have been rotated.

Practitioner guidance

• Define response triggers by supplier criticality Map vendors to the data, systems, and obligations they can affect, then trigger different containment paths based on that risk rather than on a single generic severity scale.
• Pre-stage vendor communication channels Create contact paths, escalation owners, and backup channels before any incident so teams do not waste the first response window searching for the right people.
• Tie containment to access revocation Make revoking third-party access, sessions, and tokens an explicit first-line response step whenever supplier compromise could touch your environment.

Bottom line: Supply chain incidents become harder to contain when response starts after the attacker has already used vendor access and moved beyond the first alert.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →