Notifications
Clear all
Topic starter
08/07/2026 7:05 pm
TL;DR: Supply chain attacks can halt operations for weeks, as the Jaguar Land Rover case shows, while the 2025 Cost of a Data Breach Report says they take 267 days on average to identify and contain, according to the vendor's cited sources. Business continuity planning now has to account for trusted delivery paths, privileged access, and supplier blast radius together.
NHIMG editorial — based on content published by Fudo Security: Why are supply chain attacks dangerous for business continuity?
By the numbers:
- According to The Cost of a Data Breach Report 2025, it takes an average of 267 days to identify and contain a supply chain attack.
- The breach brought global operations to a standstill for five weeks and impacted over 5,000 suppliers.
- The direct costs related to the cyber incident soared to £196 million, while revenues plummeted by nearly 25%.
Questions worth separating out
Q: How should security teams reduce supply chain risk in privileged access workflows?
A: Security teams should treat every supplier, maintainer, and remote support path as a controlled identity relationship.
Q: Why do supply chain attacks create such large business continuity impacts?
A: They use trusted channels to spread compromise across multiple systems and organisations at once.
Q: What breaks when vendor access is broad and persistent?
A: When vendor access is broad and persistent, a single compromised external identity can move laterally, modify production inputs, or maintain access long after the original task should have ended.
Practitioner guidance
- Map supplier trust paths to privileged access paths Inventory every external maintainer account, vendor-managed session, build credential, and package source that can influence production systems.
- Reduce CI/CD write authority to the smallest viable set Limit who can alter package definitions, build inputs, release artefacts, and dependency manifests.
- Apply just-in-time controls to third-party administrative access Use temporary elevation for external support, managed service, and integration accounts.
What's in the full article
Fudo Security's full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step walk through of the Axios dependency confusion scenario and the maintainer compromise path
- The vendor's comparison of SolarWinds, MOVEit, and modern build-pipeline poisoning tactics
- Specific controls used in Fudo Enterprise 6.0, including credential injection and reverse SSH
- Product examples for PAM and third-party access that are beyond the scope of this independent analysis
👉 Read Fudo Security's analysis of why supply chain attacks threaten business continuity →
Supply chain attacks and PAM: where continuity controls break down?
Explore further
08/07/2026 7:29 pm
Trusted supplier access is an identity issue, not just a procurement issue. Once a vendor, maintainer, or external service is granted operational trust, the organisation inherits their identity risk as part of its own control plane. That means compromise can occur without any direct breach of the core environment, yet still create internal privilege abuse and continuity loss. Practitioners should treat third-party identities as first-class governance objects, not as background dependencies.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when a supplier compromise disrupts operations?
A: Accountability is shared, but the owning organisation remains responsible for governing third-party access, pipeline trust, and continuity planning. Frameworks such as Zero Trust and PAM expect the business to control what external identities can do, even when the supplier operates the system. Delegated trust does not delegate responsibility.
👉 Read our full editorial: Supply chain attacks expose business continuity gaps in PAM controls
