Supply Chain Security, Safety and Risk

Why trusted software and trusted access are the new attack surface 

Modern supply chains are no longer straight lines of suppliers and customers – they are dense, interconnected ecosystems where one overlooked vulnerability can ripple outward into a global incident. A small, apparently harmless action (a missed patch, an insecure API, an unaudited open-source library) can trigger consequences far larger than the original mistake. Supply chain risk – the likelihood and potential impact of a disruption, breach, or failure originating anywhere in a supplier network – now sits alongside supply chain safety, the operational assurance that products, data, and physical processes moving through that network won’t cause harm to employees, customers, or the wider public. WithSecure’s own 2026 threat research shows exactly how this plays out in practice: attackers increasingly reach organizations not by breaking in directly, but by compromising something the organization already trusted – a vendor’s software platform, or a supplier’s unmanaged access grant. 

Supply chain risk vs. supply chain safety: what’s the difference? 

The two terms are related but distinct, and conflating them causes gaps in coverage: 

• Supply chain risk is the broader, probabilistic concept – the chance that a vendor, supplier, or partner introduces a vulnerability, outage, financial instability, or compliance failure that damages your organization. It covers cyber risk, but also geopolitical risk, single-supplier concentration risk, and financial risk. 

• Supply chain safety is narrower and more operational – it asks whether the physical products, software, and processes flowing through the chain are safe to use, deploy, or consume once they reach the end customer or employee. A backdoored firmware update or a tampered hardware component is a supply chain safety failure with cybersecurity roots. 

In practice, cybersecurity teams increasingly treat the two as inseparable: a supply chain risk (an unpatched vendor system) becomes a supply chain safety incident (malware shipped inside a trusted product) the moment it reaches production. 

Why “supply chain” is the wrong mental picture

A chain implies a straight line: raw materials in, finished product out. That model stopped matching reality years ago. Today’s typical organization works simultaneously with global cloud platforms, small local vendors, sole-trader developers, managed service providers, and open-source maintainers it has never met. WithSecure’s supply chain report describes this as a shift from “dominoes in a line” to a dense, interconnected web – which is precisely why attackers increasingly target the network itself rather than any single company. This structural shift is also why supply chain risk can no longer be assessed supplier-by-supplier in isolation: risk is cumulative and networked, not linear. A successful compromise of one supplier can cascade through dozens or thousands of downstream customers at once, turning a contained supply chain risk into a widescale supply chain safety event – which is exactly what happened with SolarWinds, Kaseya, and Log4j.

Where the real damage happens: five recurring supply chain risk patterns 

Drawing on WithSecure’s documented incidents and interviews with CISOs across retail, banking, media, and legal sectors, a handful of patterns account for most serious supply chain breaches: 

1. Trusted code repositories under attack. Attacks on open-source repositories have risen every year since 2020. Because developers reuse trusted components by default, a single compromised library – as with Log4j – can propagate into thousands of downstream products at once. 
2. Credential theft disguised as normal traffic. Modern attackers increasingly avoid loud, obvious intrusion attempts. Incidents like the Codecov breach show attackers quietly harvesting credentials for months before discovery, blending into legitimate API and cloud-control-plane activity. 
3. Consolidation that creates a single point of failure. Digital transformation projects that centralize infrastructure onto one cloud platform reduce complexity but increase blast radius – “it’s much harder for an attacker to take out an organization if it’s in a thousand different bits,” as one WithSecure consultant notes. One target replaces a thousand. 
4. Unmanaged shadow suppliers. Case studies from a global media conglomerate and a retail cooperative both describe start-ups and small vendors being granted excessive privileges – such as global admin rights without MFA – because no one owned supplier risk end-to-end. 
5. Underinvested basics. Multiple interviewees converge on the same point: the most damaging breaches rarely stem from novel zero-days. They stem from missing patch management, incomplete asset inventories (CMDBs), and absent vulnerability management – the unglamorous fundamentals that still get skipped. 

Trusted software and trusted access are the attack surface, per WithSecure’s own research 

WithSecure’s W/Labs threat intelligence team, which has investigated live incidents   and documented several 2026 cases that reinforce exactly the dynamic described above: attackers reaching organizations not by breaking in directly, but by compromising something the organization already trusted. 

• Ivanti EPMM exploitation (“Hit-and-Run,” February 2026): WithSecure’s Incident Response and STINGR teams investigated the mass exploitation of two critical remote-code-execution vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile – enterprise software thousands of organizations rely on to manage their entire mobile device fleets. Within days of a public proof-of-concept appearing, multiple threat actors were scanning for and exploiting vulnerable EPMM servers. WithSecure’s analysis of one compromised instance found a fully automated attack that installed a webshell, dumped credential databases, and exfiltrated sensitive configuration data – the entire operation completed in roughly six seconds, with reuse of an open-source offensive framework (AntSword) that let the attacker skip most of the development effort. The case is a textbook illustration of supply chain risk: a single trusted vendor platform, once compromised, becomes a direct pipeline into every customer environment running it, and the compressed time between disclosure and exploitation left defenders almost no window to patch. 

• The changing economics of Cybercrime-as-a-Service (March 2026): In this research, WithSecure documents how Initial Access Brokers have shifted from selling stolen passwords to selling live, already-authenticated session tokens harvested by infostealers – access that requires no further privilege escalation and bypasses the login-failure signals defenders traditionally watch for.WithSecure’s researchers explicitly flag third-party and supplier access as a blind spot this trend exposes: organizations that don’t know exactly which suppliers hold privileged access to their environment, and can’t audit or revoke that access quickly, are extending their attack surface through every vendor relationship they haven’t inventoried. The same report also notes that state-aligned and financially motivated groups increasingly share the same access-broker infrastructure, meaning a compromise that starts as run-of-the-mill cybercrime can just as easily end in state-aligned espionage. 

Both cases point to the same underlying supply chain safety failure mode as the historical incidents covered earlier in this report (SolarWinds, Kaseya, Log4j): the compromise doesn’t start with the victim organization’s own code or network. It starts with something they trusted – a vendor’s software, a supplier’s access grant – and the damage travels through that trust relationship faster than most organizations can detect or respond.

What “good” supply chain security, safety, and risk management looks like in practice 

Based on both WithSecure’s ebook, case studies and its 2026 W/Labs research, effective supply chain security programs manage risk and safety as a single, connected discipline: 

• Run a formal supply chain risk assessment before onboarding any vendor. Score suppliers on data access, criticality, financial stability, and geopolitical exposure – not just technical security posture – so risk decisions are evidence-based rather than assumed. 

• Map the real perimeter. Use External Attack Surface Management (EASM) to understand cloud services, shared services, and remote-access points that extend far beyond the traditional network edge. 

• Extend due diligence to every supplier, not just IT vendors. One law firm CISO issues security questionnaires to taxi companies and florists, not just SaaS providers – because any party handling sensitive data or physical access is part of the attack surface. 

• Adopt EDR and telemetry of actions, not just endpoints. As attackers pivot to abusing legitimate cloud APIs (creating accounts, modifying permissions, granting external access), detection needs to cover control-plane activity, not just device-level signals. 

• Tier suppliers by risk, not by size. A small start-up with access to global admin rights is a bigger risk than a large vendor with narrow, well-scoped permissions. 

• Build supplier risk into contracts and SLAs upfront, rather than retrofitting security after a transformation project is complete – a recurring failure mode WithSecure experts flag repeatedly. 

• Know exactly which suppliers hold privileged access to your environment, and be able to revoke it fast. WithSecure’s own 2026 research on Initial Access Brokers found that unaudited third-party access is now one of the most common entry points attackers exploit, precisely because organizations can’t answer “who has access, and can we cut it off quickly?” 

• Patch trusted vendor platforms as urgently as you’d patch your own systems. The Ivanti EPMM case shows that the gap between a public proof-of-concept exploit and mass exploitation can now be measured in days, not weeks – vendor software is not a lower-priority patching tier just because you didn’t write the code. 

The bottom line 

Supply chain security is a problem of trust, not just technology. Attackers exploit the sheer density and interconnectedness of modern digital ecosystems, where small, invisible weaknesses – a single compromised vendor platform, one unmanaged supplier access grant – cascade into major incidents. WithSecure’s own 2026 casework shows how fast that cascade now moves: a fully automated attack chain, as in the Ivanti EPMM case, can complete credential theft and exfiltration in seconds once it starts. Managing supply chain risk well is what ultimately delivers supply chain safety: products, code, and data that can be trusted once they reach the people who depend on them. As WithSecure frames it, the safest path is the same one that has always applied in complex, high-risk environments: think like an attacker, collaborate as a team across every link in the chain, and don’t wait for a breach to force the basics. 

Frequently asked questions 

What is supply chain risk in cybersecurity? 

Supply chain risk is the potential for a supplier, vendor, or third party anywhere in an organization’s network to introduce a vulnerability, disruption, or compliance failure that causes harm downstream – ranging from a compromised open-source library to a financially unstable vendor that can’t sustain security investment. 

What is supply chain safety? 

Supply chain safety is the assurance that the products, software, and data moving through a supply chain are free of hidden defects, backdoors, or tampering by the time they reach the end user – the operational outcome that good supply chain risk management is meant to produce. 

How are supply chain risk and supply chain security different? 

Supply chain security refers to the set of controls, technologies, and processes (EDR, EASM, vendor questionnaires, patch management) used to reduce supply chain risk. Risk is the exposure being measured; security is the practice of managing it down; safety is the real-world result when that management works. 

Sources: WithSecure, “Supply Chain Security: How to Avoid the Butterfly Effect – and What It Really Means” (ebook), WithSecure, “Supply Chain 2024: If the Hackers Don’t Get You, the Regulations Will!” (webinar); WithSecure W/Labs, “Ivanti EPMM Exploitation: Hit-and-Run” (2026); WithSecure W/Labs, “The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know” (2026).