Topic starter
08/07/2026 7:05 pm
TL;DR: Supply chain attacks exploit trusted vendor relationships, build pipelines, and third-party access paths, and Fudo Security cites IBM data showing an average 267 days to identify and contain these incidents. PAM can narrow post-compromise movement, but it does not remove the trust assumptions embedded in supplier access and delivery channels.
Editorial analysis by NHI Mgmt Group, based on content published by Fudo Security: “Fudo Security”.
By the numbers:
- The average time to identify and contain a supply chain attack is 267 days.
- Jaguar Land Rover's cyberattack affected over 5,000 suppliers and drove direct costs of £196 million.
- Jaguar Land Rover's revenues fell by nearly 25% after the incident.
Key questions
Q: What breaks when third-party access is not tightly governed in supply chain environments?
A: The trust relationship itself becomes the attack path.
Q: Why do supply chain attacks create such large business continuity impacts?
A: They use trusted channels to spread compromise across multiple systems and organisations at once.
Q: What do security teams get wrong about PAM in supply chain risk?
A: Teams often treat PAM as if it can validate the legitimacy of the upstream relationship, when it mainly limits what an attacker can do after access is granted.
Practitioner guidance
- Map supplier trust paths to identity controls Inventory every external vendor account, maintainer identity, support channel, and software delivery path that can reach production or sensitive systems.
- Constrain third-party access lifecycles Apply joiner-mover-leaver discipline to third parties, including explicit offboarding, access expiry, and reapproval for renewed access.
- Treat build provenance as a security gate Require provenance checks for dependencies, releases, and build artifacts before they can reach production.
Bottom line: Supply chain attacks now turn trusted vendor access, dependencies, and delivery systems into attack paths that bypass ordinary perimeter thinking.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:29 pm
Supply chain trust has become an identity problem, not just a software problem: The article shows that attackers increasingly exploit the identities behind vendors, maintainers, and remote management paths. Once a supplier account or delivery workflow is trusted, compromise can scale across many downstream organisations. The practitioner conclusion is clear: governance has to extend to the identities operating outside the firewall.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: How should organisations compare third-party access controls and build provenance controls?
A: Third-party access controls govern who can enter and what they can do once inside, while build provenance controls govern whether the delivered software or artifact should be trusted at all. Both are needed, but they solve different problems. If the article shows upstream compromise, provenance has to come before session control.
👉 Read our full editorial: Supply chain attacks expose the limits of current PAM controls