A supply chain is defined as a network between a company and its suppliers to produce and distribute a specific product or service to a list of final buyers. This network includes different activities, involving various people and entities, information, and resources. In today’s world, every aspect of the world and especially business is exposed to technology; more specifically the supply chain owners and participants need to make sure that not only their companies are secure from cyber-attacks, but the rest of the affiliates of the supply chain are secured as well. This need becomes more prominent with the rise in popularity of ransomware attacks, which are not just yet another type of malware, but it is a criminal business model, in which the perpetrator seeks to obtain benefit by taking hostage of a victim’s data, infrastructure, economic output, intellectual property, or even privacy. To put this trend in perspective, companies, and organizations of all sizes around the world, from SMEs, mid-sized and multinationals to the public sector and governments, faced a 148% increase in 2021 by ransomware hits.

Regarding supply chains in particular, the perpetrators are targeting essential goods and services (there are examples from the health and safety, oil and gas sector etc.), because the criticality and effect on daily life increases the urgency for resolution and makes the chance of ransom payment much more likely and immediate. The cases we see are increasing in success, and as more attacks gain the attention of the media, hackers are realizing that they can extort companies with a large customer base to maximize the impact of their attacks. This, paired with the scale of many organizations’ vendor ecosystems, poses an enormous emphasis on preventing supply chain attacks through third-party Risk management.