Topic starter
02/08/2026 12:24 pm
TL;DR: Recent incidents show that suppliers can become single points of failure, and Anomali argues CTI teams should assess vendor cybersecurity readiness from the start of procurement rather than relying on checkbox compliance. The practical shift is toward evidence-based vendor due diligence, where exposed services, weak authentication, and poor security staffing become decision factors, not afterthoughts.
Editorial analysis by NHI Mgmt Group, based on content published by Anomali: “Supply Chain Breach, or a Lack of Due Diligence?”.
Key questions
Q: How should security teams assess vendor risk before procurement decisions are finalised?
A: Start with externally visible control evidence.
Q: Why do weak supplier controls increase customer cyber risk?
A: Because suppliers often sit on privileged access paths, sensitive data flows, or operational dependencies.
Q: What are the warning signs that a third-party vendor is too risky to trust with sensitive data?
A: Warning signs include poor security policies, weak access controls, no clear incident response plan, unresolved compliance gaps, a history of breaches or complaints, and unclear physical security practices.
Practitioner guidance
- Start vendor reviews before procurement finalisation Bring CTI, IAM, and security operations into vendor selection early enough to assess exposure, authentication, and response maturity before commercial commitment.
- Verify external attack surface and internet exposure Check for unnecessary ports, legacy protocols, vulnerable services, and exposed development or QA systems as part of third-party due diligence.
- Assess authentication and federation controls Require strong MFA, SSO support, and certificate hygiene before allowing a supplier to handle sensitive data or privileged integrations.
Bottom line: Supplier risk is now a security control issue because exposed services and weak authentication can turn a vendor into a single point of failure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
Supplier due diligence has become part of security control design, not just vendor selection. If a supplier exposes unnecessary services or runs weak authentication, the customer inherits an access problem before any contract is signed. That is why third-party risk needs to sit inside procurement, IAM, and resilience governance together. Practitioners should treat supplier posture as an extension of the control environment.
A few things that frame the scale:
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: Who should own third-party security due diligence in an organisation?
A: Procurement alone should not own it. CTI, IAM, security operations, and leadership all have a role because vendor risk affects access control, resilience, and data protection. If a supplier can become a single point of failure, accountability has to sit across both buying and security decisions.
👉 Read our full editorial: Supply chain due diligence is now a cybersecurity control issue