{"id":13676,"date":"2026-03-11T13:07:00","date_gmt":"2026-03-11T11:07:00","guid":{"rendered":"https:\/\/www.withsecure.com\/?p=13676"},"modified":"2026-09-14T08:37:25","modified_gmt":"2026-09-14T05:37:25","slug":"supply-chain-security-safety-and-risk","status":"publish","type":"post","link":"https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/","title":{"rendered":"Supply Chain Security, Safety and Risk"},"content":{"rendered":"<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 wp-block-one-column-block--meta-sharing layout--spacing-xxxxl-top layout--spacing-xl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <figure class=\"wp-component-image__figure\">\n                                            <img loading=\"lazy\" decoding=\"async\" width=\"2560\" height=\"1707\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-scaled.jpg.webp\" class=\"wp-component-image\n                            wp-component-image--desktop\n                            wp-component-image--mobile\n                            wp-component-image--ratio-content-3-2 wp-component-image--fit-cover\" alt=\"\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-scaled.jpg.webp 2560w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-300x200.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-1024x683.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-768x512.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-1536x1024.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-2048x1365.jpg.webp 2048w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-447x298.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WithSecure_abstract_networks-219x146.jpg.webp 219w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/>                                                    <\/figure>\n                    <\/div>\n                                                                    <div class='wp-block-one-column-block__meta-sharing-grid'><div class=\"wp-component-content wp-component-content--default wp-block-one-column-block__content fade-in\">\n            <h1 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Supply Chain Security, <span class=\"blue-text\">Safety and Risk<\/span><\/h1>                    <div class=\"wp-component-content__inner\">\n                                                    <div class=\"wp-component-content__meta\">\n                                                    <span class=\"wp-component-content__content-type\">\n                                Blog                            <\/span>\n                                                                            <span class=\"wp-component-content__meta-categories\">\n                                                                    <span class=\"wp-component-content__meta-category\">\n                                        Mid-market                                    <\/span>\n                                                            <\/span>\n                                                                                                    <span class=\"wp-component-content__meta-date\">\n                                11 March, 2026                            <\/span>\n                                                                    <\/div>\n                                            <\/div>\n                <\/div><section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--content-1 wp-block-sharing-icons--disable-container wp-block-one-column-block__sharing fade-in wp-block-one-column-block__sharing fade-in\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/&#038;title=Supply%20Chain%20Security,%20Safety%20and%20Risk\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Supply Chain Security, Safety and Risk&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n<\/div>                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-one-column-block edwp-block js-wp-block-one-column-block wp-block-one-column-block--content-1 layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-one-column-block__container\">\n                                                                                                                                    <div class=\"wp-component-image__wrapper wp-block-one-column-block__image fade-in\">\n                    <\/div>\n                                                                                <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-two-column-block edwp-block js-wp-block-two-column-block wp-block-two-column-block--content-1 wp-block-two-column-block__left--align-y-top wp-block-two-column-block__right--align-y-top wp-block-two-column-block--split-sidebar layout--none-top layout--spacing-xxxl-bottom\"\n    data-block-id=\"block_4638bf9f6b21b11e3c267c65383787df\"\n    >\n    <div class=\"wp-block-two-column-block__container row-load\">\n                                                        <div class=\"wp-block-two-column-block__left\">\n                                <nav\n    class=\"wp-component-content-navigation wp-block-two-column-block__content-nav js-content-navigation\"\n    data-bem-base=\"wp-component-content-navigation\"\n    data-nav-column=\"left\"\n    data-nav-type=\"auto\"\n>\n            <p class=\"wp-component-content-navigation__title\">\n            Content        <\/p>\n    \n    <div class=\"wp-component-content-navigation__mobile\">\n        <label class=\"wp-component-content-navigation__mobile-label\">\n            <span class=\"wp-component-content-navigation__mobile-label-text\">\n                Content navigation            <\/span>\n            <select class=\"wp-component-content-navigation__select js-content-navigation-select\">\n                <option value=\"\">\n                    Select a section                <\/option>\n                            <\/select>\n        <\/label>\n    <\/div>\n\n    <div class=\"wp-component-content-navigation__desktop\">\n        <div class=\"wp-component-content-navigation__list-wrapper\">\n            <span\n                class=\"wp-component-content-navigation__indicator js-content-navigation-indicator\"\n                aria-hidden=\"true\"\n            ><\/span>\n            <ul class=\"wp-component-content-navigation__list js-content-navigation-list\">\n                            <\/ul>\n        <\/div>\n    <\/div>\n<\/nav>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__hide-mobile wp-block-two-column-block__share wp-block-two-column-block__hide-mobile\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/&#038;title=Supply%20Chain%20Security,%20Safety%20and%20Risk\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Supply Chain Security, Safety and Risk&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                                                <div class=\"wp-block-two-column-block__right\">\n                                <div class=\"wp-component-paragraph wp-block-two-column-block__paragraph \">\n    <h2><span class=\"TextRun SCXW65159988 BCX8\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW65159988 BCX8\">Why <\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">t<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">rusted\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">s<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">oftware and\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">t<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">rusted\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">a<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">ccess\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">a<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">re the\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">n<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">ew\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">a<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">ttack\u00a0<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">s<\/span><span class=\"NormalTextRun SCXW65159988 BCX8\">urface<\/span><\/span><span class=\"EOP Selected SCXW65159988 BCX8\" data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;201341983&quot;:0,&quot;335551550&quot;:1,&quot;335551620&quot;:1,&quot;335559685&quot;:0,&quot;335559737&quot;:0,&quot;335559738&quot;:0,&quot;335559739&quot;:360,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span class=\"TextRun SCXW63207102 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW63207102 BCX8\">Modern supply chains are no longer straight lines of suppliers and customers\u00a0<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u2013<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0they are dense, interconnected ecosystems where one overlooked vulnerability can ripple outward into a global incident. A small,\u00a0<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">apparently harmless<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0action (a missed patch, an insecure API, an unaudited open-source library) can trigger consequences far larger than the original mistake.\u00a0<\/span><\/span><span class=\"TextRun SCXW63207102 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW63207102 BCX8\">Supply chain risk<\/span><\/span><span class=\"TextRun SCXW63207102 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u2013<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0the likelihood and potential impact of a disruption, breach, or failure originating anywhere in a supplier network\u00a0<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u2013<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0now sits alongside\u00a0<\/span><\/span><span class=\"TextRun SCXW63207102 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW63207102 BCX8\">supply chain safety<\/span><\/span><span class=\"TextRun SCXW63207102 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW63207102 BCX8\">, the operational assurance that products, data, and physical processes moving through that network won&#8217;t cause harm to employees, customers, or the wider public.\u00a0<\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW63207102 BCX8\">WithSecure&#8217;s<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0own 2026 threat research shows exactly how this plays out in practice: attackers increasingly reach organizations not by breaking in directly, but by compromising something the organization already trusted\u00a0<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u2013<\/span><span class=\"NormalTextRun SCXW63207102 BCX8\">\u00a0a vendor&#8217;s software platform, or a supplier&#8217;s unmanaged access grant.<\/span><\/span><span class=\"EOP Selected SCXW63207102 BCX8\" data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h2><span class=\"TextRun SCXW163660391 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW163660391 BCX8\" data-ccp-parastyle=\"heading 1\">Supply chain risk vs. supply chain safety: <\/span><span class=\"NormalTextRun SCXW163660391 BCX8\" data-ccp-parastyle=\"heading 1\">what&#8217;s<\/span><span class=\"NormalTextRun SCXW163660391 BCX8\" data-ccp-parastyle=\"heading 1\">\u00a0the difference?<\/span><\/span><span class=\"EOP Selected SCXW163660391 BCX8\" data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">The two terms are related but distinct, and conflating them causes gaps in coverage:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Supply chain risk<\/span><\/b><span data-contrast=\"auto\">\u00a0is the broader, probabilistic concept\u00a0\u2013\u00a0the chance that a vendor, supplier, or partner introduces a vulnerability, outage, financial instability, or compliance failure that damages your organization. It covers cyber risk, but also geopolitical risk, single-supplier concentration risk, and financial risk.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Supply chain safety<\/span><\/b><span data-contrast=\"auto\">\u00a0is narrower and more operational\u00a0\u2013\u00a0it asks whether the physical products, software, and processes flowing through the chain are safe to use, deploy, or consume once they reach the\u00a0end\u00a0customer or employee. A backdoored firmware update or a tampered hardware\u00a0component\u00a0is a supply chain safety failure with cybersecurity roots.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">In practice, cybersecurity teams increasingly treat the two as inseparable: a supply chain risk (an unpatched vendor system) becomes a supply chain safety incident (malware shipped inside a trusted product) the moment it reaches production.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h2>Why &#8220;supply chain&#8221; is the wrong mental picture<\/h2>\n<p>A chain implies a straight line: raw materials in, finished product out. That model stopped matching reality years ago. Today&#8217;s typical organization works simultaneously with global cloud platforms, small local vendors, sole-trader developers, managed service providers, and open-source maintainers it has never met. <a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/22022-05-19-WS-Supply-chain_ebook-horizontal.pdf\">WithSecure&#8217;s supply chain report<\/a> describes this as a shift from &#8220;dominoes in a line&#8221; to a dense, interconnected web \u2013 which is precisely why attackers increasingly target the network itself rather than any single company. This structural shift is also why supply chain risk can no longer be assessed supplier-by-supplier in isolation: risk is cumulative and networked, not linear. A successful compromise of one supplier can cascade through dozens or thousands of downstream customers at once, turning a contained supply chain risk into a widescale supply chain safety event \u2013 which is exactly what happened with SolarWinds, Kaseya, and Log4j.<\/p>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">Where the real damage happens: five recurring supply chain risk patterns<\/span><span data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Drawing on\u00a0WithSecure&#8217;s\u00a0documented incidents and interviews with CISOs across retail, banking, media, and legal sectors, a handful of patterns account for most serious supply chain breaches:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:431,&quot;335559991&quot;:431,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Trusted code repositories under attack.\u00a0<\/span><\/b><span data-contrast=\"auto\">Attacks on open-source repositories have risen every year since 2020. Because developers reuse trusted components by default, a single compromised library\u00a0\u2013\u00a0as with\u00a0<a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/22022-05-19-WS-Supply-chain_ebook-horizontal.pdf\">Log4j<\/a>\u00a0\u2013\u00a0can propagate into thousands of downstream products at once.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:431,&quot;335559991&quot;:431,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Credential theft disguised as normal traffic.\u00a0<\/span><\/b><span data-contrast=\"auto\">Modern attackers increasingly avoid loud, obvious intrusion attempts. Incidents like the\u00a0<\/span><a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/22022-05-19-WS-Supply-chain_ebook-horizontal.pdf\"><span data-contrast=\"auto\">Codecov breach<\/span><\/a><span data-contrast=\"auto\">\u00a0show attackers quietly harvesting credentials for months before discovery, blending into legitimate API and cloud-control-plane activity.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:431,&quot;335559991&quot;:431,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Consolidation that\u00a0creates a single point of failure.\u00a0<\/span><\/b><span data-contrast=\"auto\">Digital transformation projects that centralize infrastructure onto one cloud platform reduce complexity but increase blast radius\u00a0\u2013\u00a0&#8220;it&#8217;s much harder for an attacker to take out an organization if it&#8217;s in a thousand different bits,&#8221; as one WithSecure consultant notes. One target replaces a thousand.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:431,&quot;335559991&quot;:431,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Unmanaged shadow suppliers.\u00a0<\/span><\/b><span data-contrast=\"auto\">Case studies from a global media conglomerate and a retail cooperative both describe start-ups and small vendors being granted excessive privileges\u00a0\u2013\u00a0such as global admin rights without MFA\u00a0\u2013\u00a0because no one owned supplier risk end-to-end.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:431,&quot;335559991&quot;:431,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Underinvested basics.\u00a0<\/span><\/b><span data-contrast=\"auto\">Multiple interviewees converge on the same point: the most damaging breaches rarely stem from novel\u00a0zero-days. They stem from missing patch management, incomplete asset inventories (CMDBs), and absent vulnerability management\u00a0\u2013\u00a0the\u00a0unglamorous\u00a0fundamentals that still get skipped.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ol>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">Trusted software and trusted access are the attack surface, per\u00a0WithSecure&#8217;s\u00a0own research<\/span><span data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">WithSecure&#8217;s\u00a0W\/Labs threat intelligence team, which\u00a0has\u00a0investigated\u00a0live incidents\u00a0\u00a0\u00a0and\u00a0documented several 2026 cases that reinforce exactly the dynamic described above: attackers reaching organizations not by breaking in directly, but by compromising something the organization already trusted.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><a href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\"><span data-contrast=\"auto\">Ivanti EPMM exploitation (&#8220;Hit-and-Run,&#8221; February 2026)<\/span><\/a><span data-contrast=\"auto\">:\u00a0WithSecure&#8217;s\u00a0Incident Response and STINGR teams investigated the mass exploitation of two critical remote-code-execution\u00a0vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in Ivanti Endpoint Manager Mobile\u00a0\u2013\u00a0enterprise software thousands of organizations rely on to manage their entire mobile device fleets. Within days of a public proof-of-concept appearing, multiple threat actors were\u00a0scanning for\u00a0and exploiting vulnerable EPMM servers.\u00a0<\/span><span data-contrast=\"auto\">WithSecure&#8217;s analysis of one compromised instance found a fully automated attack that installed a\u00a0webshell, dumped credential databases, and exfiltrated sensitive configuration data\u00a0\u2013\u00a0the entire operation completed in roughly six seconds, with reuse of an open-source offensive framework (AntSword) that let the attacker skip most of the development effort. The case is a textbook illustration of supply chain risk: a single trusted vendor platform, once compromised, becomes a direct pipeline into every customer environment running it, and the compressed time between disclosure and exploitation left defenders almost no window to patch.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><a href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\"><span data-contrast=\"auto\">The changing economics of Cybercrime-as-a-Service (March 2026)<\/span><\/a><span data-contrast=\"auto\">: In this research, WithSecure documents how Initial Access Brokers have shifted from selling stolen passwords to selling live, already-authenticated session tokens harvested by infostealers\u00a0\u2013\u00a0access that requires no further privilege escalation and bypasses the login-failure signals defenders traditionally watch for.<\/span><span data-contrast=\"auto\">WithSecure&#8217;s\u00a0researchers explicitly flag third-party and supplier access as a blind spot this trend exposes: organizations that don&#8217;t know exactly which suppliers hold privileged access to their environment, and can&#8217;t audit or revoke that access quickly, are extending their attack surface through every vendor relationship they haven&#8217;t inventoried. The same report also notes that state-aligned and financially motivated groups increasingly share the same access-broker infrastructure, meaning a compromise that starts as run-of-the-mill cybercrime can just as easily end in state-aligned espionage.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Both cases point to the same underlying supply chain safety failure mode as the historical incidents covered earlier in this report (SolarWinds, Kaseya, Log4j): the compromise\u00a0doesn&#8217;t\u00a0start with the victim organization&#8217;s own code or network. It starts with something they\u00a0trusted\u00a0\u2013\u00a0a\u00a0vendor&#8217;s\u00a0software, a\u00a0supplier&#8217;s\u00a0access grant\u00a0\u2013\u00a0and the damage travels through that trust relationship faster than most organizations can detect or respond.<\/span><\/p>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">What &#8220;good&#8221; supply chain security, safety, and risk management looks like in practice<\/span><span data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Based on both <a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/22022-05-19-WS-Supply-chain_ebook-horizontal.pdf\">WithSecure&#8217;s ebook<\/a>, case studies and its 2026 W\/Labs research, effective supply chain security programs manage risk and safety as a single, connected discipline:<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Run a formal supply chain risk assessment before onboarding any vendor.\u00a0<\/span><\/b><span data-contrast=\"auto\">Score suppliers on data access, criticality, financial stability, and geopolitical exposure\u00a0\u2013\u00a0not just technical security posture\u00a0\u2013\u00a0so risk decisions are evidence-based rather than assumed.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Map the real perimeter.\u00a0<\/span><\/b><span data-contrast=\"auto\">Use External Attack Surface Management (EASM) to understand cloud services, shared services, and remote-access points that extend far beyond the traditional network edge.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"7\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Extend due diligence to every supplier, not just IT vendors.\u00a0<\/span><\/b><span data-contrast=\"auto\">One law\u00a0firm\u00a0CISO issues security questionnaires to taxi companies and florists, not just SaaS providers\u00a0\u2013\u00a0because any party handling sensitive data or physical access is part of the attack surface.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"8\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Adopt EDR and telemetry of actions, not just endpoints.\u00a0<\/span><\/b><span data-contrast=\"auto\">As attackers pivot to abusing legitimate cloud APIs (creating accounts,\u00a0modifying\u00a0permissions, granting external access), detection needs to cover control-plane activity, not just device-level signals.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"9\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Tier suppliers by risk, not by size.\u00a0<\/span><\/b><span data-contrast=\"auto\">A small start-up with access to global admin rights is a bigger risk than a large vendor with narrow, well-scoped permissions.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"10\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Build supplier risk into contracts and SLAs upfront,\u00a0<\/span><\/b><span data-contrast=\"auto\">rather than retrofitting security after a transformation project is complete\u00a0\u2013\u00a0a recurring failure mode WithSecure\u00a0experts\u00a0flag repeatedly.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"11\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Know exactly which suppliers hold privileged access to your\u00a0environment, and\u00a0be able to revoke it fast.\u00a0<\/span><\/b><span data-contrast=\"auto\">WithSecure&#8217;s\u00a0own 2026 research on Initial Access Brokers found that unaudited third-party access is now one of the most common entry points attackers\u00a0exploit, precisely because organizations\u00a0can&#8217;t\u00a0answer\u00a0&#8220;who has access, and can we cut it off quickly?&#8221;<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\u2022\" data-font=\"\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:360,&quot;335559991&quot;:360,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\u2022&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"12\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Patch trusted vendor platforms as urgently as\u00a0you&#8217;d\u00a0patch your own systems.\u00a0<\/span><\/b><span data-contrast=\"auto\">The Ivanti EPMM case shows that the gap between a public proof-of-concept exploit and mass exploitation can now be measured in days, not weeks\u00a0\u2013\u00a0vendor software is not a lower-priority patching tier just because you\u00a0didn&#8217;t\u00a0write the code.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:120,&quot;335559740&quot;:276}\">\u00a0<\/span><\/li>\n<\/ul>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">The bottom line<\/span><span data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Supply chain security is a problem of trust, not just technology. Attackers exploit the sheer density and interconnectedness of modern digital ecosystems,\u00a0where\u00a0small, invisible weaknesses\u00a0\u2013\u00a0a single compromised vendor platform, one unmanaged supplier access grant\u00a0\u2013\u00a0cascade into major incidents.\u00a0WithSecure&#8217;s\u00a0own 2026 casework shows how fast that cascade now moves: a fully automated attack chain, as in the Ivanti EPMM case, can complete credential theft and exfiltration in seconds once it starts. Managing supply chain risk well is what\u00a0ultimately delivers\u00a0supply chain safety: products, code, and data that can be trusted once they reach the people who depend on them. As WithSecure frames it, the safest path is the same one that has always applied in complex, high-risk environments: think like an attacker, collaborate as a team across every link in the chain, and don&#8217;t wait for a breach to force the basics.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<h2 aria-level=\"1\"><span data-contrast=\"none\">Frequently asked questions<\/span><span data-ccp-props=\"{&quot;335559738&quot;:360,&quot;335559739&quot;:200}\">\u00a0<\/span><\/h2>\n<p><b><span data-contrast=\"auto\">What is supply chain risk in cybersecurity?<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:200,&quot;335559739&quot;:60}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Supply chain risk is the potential for a supplier, vendor, or third party anywhere in an organization&#8217;s network to introduce a vulnerability, disruption, or compliance failure that causes harm downstream\u00a0\u2013\u00a0ranging from a compromised open-source library to a financially unstable vendor that can&#8217;t sustain security investment.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">What is supply chain safety?<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:200,&quot;335559739&quot;:60}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Supply chain safety is the assurance that the products, software, and data moving through a supply chain are free of hidden defects, backdoors, or tampering by the time they reach the end user\u00a0\u2013\u00a0the operational outcome that good supply chain risk management is meant to produce.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">How are supply chain risk and supply chain security different?<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:200,&quot;335559739&quot;:60}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Supply chain security refers to the set of controls, technologies, and processes (EDR, EASM, vendor questionnaires, patch management) used to reduce supply chain risk. Risk is the exposure being measured; security is the practice of managing\u00a0it down; safety is the real-world result when that management works.<\/span><span data-ccp-props=\"{&quot;201341983&quot;:0,&quot;335559739&quot;:200,&quot;335559740&quot;:276}\">\u00a0<\/span><\/p>\n<p><span class=\"TextRun SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\">Sources:\u00a0<\/span><a href=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/22022-05-19-WS-Supply-chain_ebook-horizontal.pdf\"><span class=\"NormalTextRun CommentStart CommentHighlightPipeRest CommentHighlightRest SCXW136539107 BCX8\">WithSecure, &#8220;Supply Chain Security: How to Avoid the Butterfly Effect \u2013 and What It Really Means&#8221; (<\/span><span class=\"NormalTextRun SpellingErrorV2Themed CommentHighlightRest SCXW136539107 BCX8\">ebook<\/span><\/a><span class=\"NormalTextRun CommentHighlightRest SCXW136539107 BCX8\">),<\/span><span class=\"NormalTextRun CommentHighlightPipeRest SCXW136539107 BCX8\">\u00a0<\/span><\/span><a class=\"Hyperlink SCXW136539107 BCX8\" href=\"https:\/\/youtu.be\/u3iiiBVTurE\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\" data-ccp-charstyle=\"Hyperlink\">WithSecure, &#8220;Supply Chain 2024: If the Hackers Don&#8217;t Get You, the Regulations Will!&#8221; (webinar)<\/span><\/span><\/a><span class=\"TextRun SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\">;\u00a0<\/span><\/span><a class=\"Hyperlink SCXW136539107 BCX8\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/ivanti-epmm-exploitation\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\" data-ccp-charstyle=\"Hyperlink\">WithSecure W\/Labs, &#8220;Ivanti EPMM Exploitation: Hit-and-Run&#8221; (2026); WithSecure W\/Labs<\/span><\/span><\/a><span class=\"TextRun SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\">,\u00a0<\/span><\/span><a class=\"Hyperlink SCXW136539107 BCX8\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/w-labs\/changing-economics-of-cybercrime-as-a-service\/\" target=\"_blank\" rel=\"noreferrer noopener\"><span class=\"TextRun Underlined SCXW136539107 BCX8\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW136539107 BCX8\" data-ccp-charstyle=\"Hyperlink\">&#8220;The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know&#8221; (2026).<\/span><\/span><\/a><span class=\"EOP Selected SCXW136539107 BCX8\" data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<\/div>\n<section\n    class=\"wp-block-sharing-icons edwp-block wp-block-sharing-icons--disable-border wp-block-sharing-icons--disable-container wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right wp-block-two-column-block__share wp-block-two-column-block__mobile-after-right\"\n    >\n    <div class=\"wp-block-sharing-icons__container\">\n        <div class=\"wp-block-sharing-icons__inner\">\n                            <p class=\"wp-block-sharing-icons__title fade-in\">\n                    Share this story                <\/p>\n                        <div class=\"wp-component-socials wp-component-socials--dark-mode\">\n    \n            <a href=\"https:\/\/www.linkedin.com\/shareArticle?mini=true&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/&#038;title=Supply%20Chain%20Security,%20Safety%20and%20Risk\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link\" title=\"Share on Linkedin\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#linkedin'><\/use>\n            <\/svg>        <\/a>\n    \n            <a href=\"http:\/\/x.com\/share?text=Supply Chain Security, Safety and Risk&#038;url=https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/\" target=\"_blank\" rel=\"noreferer noopener\" class=\"wp-component-socials__link wp-component-socials__link--twitter\" title=\"Share on Twitter\">\n            <svg class='edwp-icon edwp-icon--xlg js-icon ' aria-hidden='true'>\n                <use xlink:href='#x'><\/use>\n            <\/svg>        <\/a>\n    \n    \n    <\/div>\n        <\/div>\n    <\/div>\n<\/section>\n                <\/div>\n                        <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-cards edwp-block wp-block-cards--col-3 layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n    <div class=\"wp-block-cards__container\">\n        <div class=\"wp-component-content wp-component-content--default wp-block-cards__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Blog <span class=\"blue-text\">post<\/span><\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <p>Read our latest blogs<\/p>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                                            <div class=\"wp-block-cards__cards row-load\">\n                    <div class=\"wp-component-card-insight wp-block-cards__card wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"AI Security hero image with iceberg\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1.jpg.webp 1920w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-300x169.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-1024x576.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-768x432.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-1536x864.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-447x251.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-700x394.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-260x146.jpg.webp 260w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Introducing AI Security in WithSecure\u2122 Elements<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">WithSecure\u2122 Elements now surfaces shadow AI, AI browser extensions, and agentic identities in one place. Here&#039;s what&#039;s shipping, and why visibility comes first.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/introducing-ai-security-in-withsecure-elements\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div><div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1080\" src=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1.jpg.webp\" class=\"wp-component-card-insight__image\" alt=\"AI Security hero image with iceberg\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1.jpg.webp 1920w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-300x169.jpg.webp 300w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-1024x576.jpg.webp 1024w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-768x432.jpg.webp 768w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-1536x864.jpg.webp 1536w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-447x251.jpg.webp 447w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-700x394.jpg.webp 700w, https:\/\/www.withsecure.com\/wp-content\/smush-webp\/2026\/09\/WS_AI_Security_1920x1080_blog-1-260x146.jpg.webp 260w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">AI<\/span>\n                                            <span class=\"wp-component-card-insight__category\">AI Security<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">AI Security: Why It&#8217;s Now a Board-Level Priority<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">AI security is now a board-level issue. See the real pain points, what AI security actually means, and the steps to get ahead of it.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/ai-security-why-its-now-a-board-level-priority\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div><div class=\"wp-component-card-insight wp-block-cards__card\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img loading=\"lazy\" decoding=\"async\" width=\"163\" height=\"130\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/04\/AV-comparatives.svg\" class=\"wp-component-card-insight__image\" alt=\"\" \/>                    <p class=\"wp-component-card-insight__content-type\">Industry Recognition<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Endpoint Security<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Certified Leader in AV-Comparatives&#8217; Endpoint Prevention and Response<\/h3>\n                                            <p class=\"wp-component-card-insight__desc\">AV-Comparatives named WithSecure \u2018Certified Leader\u2019 for Endpoint Prevention and Response (EPR), \u2018Advanced+ Performance\u2019 for Windows, \u2018Advanced Real-World Protection\u2019 for Windows, \u2018Approved Mac Security\u2019 for MacOS and \u2018Approved Mobile Security\u2019 for Android.<\/p>\n                            <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/strategic-leader-in-av-comparatives-endpoint-prevention-and-response\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>                <\/div>\n                                                <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":20,"featured_media":13678,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[468],"tags":[],"content_type":[],"class_list":["post-13676","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mid-market"],"acf":[],"card":"<div class=\"wp-component-card-insight js-card-link wp-component-card-insight--highlighted\">\n    <div class=\"wp-component-card-insight__image-wrapper\">\n        <img width=\"2560\" height=\"1707\" src=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-scaled.jpg\" class=\"wp-component-card-insight__image\" alt=\"\" decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-scaled.jpg 2560w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-300x200.jpg 300w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-1024x683.jpg 1024w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-768x512.jpg 768w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-1536x1024.jpg 1536w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-2048x1365.jpg 2048w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-447x298.jpg 447w, https:\/\/www.withsecure.com\/wp-content\/uploads\/2026\/09\/WithSecure_abstract_networks-219x146.jpg 219w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\" \/>                    <p class=\"wp-component-card-insight__content-type\">Blog<\/p>\n            <\/div>\n    <div class=\"wp-component-card-insight__content\">\n                    <div class=\"wp-component-card-insight__meta\">\n                <div class=\"wp-component-card-insight__categories\">\n                                            <span class=\"wp-component-card-insight__category\">Mid-market<\/span>\n                                    <\/div>\n            <\/div>\n                            <h3 class=\"wp-component-card-insight__title\">Supply Chain Security, Safety and Risk<\/h3>\n                                                    <div class=\"wp-component-card-insight__button-wrapper\">\n                <a class=\"wp-component-button btn btn--primary btn--dark wp-component-card-insight__button btn--small\" href=\"https:\/\/www.withsecure.com\/en\/resources-hub\/blog\/supply-chain-security-safety-and-risk\/\">Read more<\/a>            <\/div>\n            <\/div>\n<\/div>","_links":{"self":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/posts\/13676","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/comments?post=13676"}],"version-history":[{"count":7,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/posts\/13676\/revisions"}],"predecessor-version":[{"id":13687,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/posts\/13676\/revisions\/13687"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media\/13678"}],"wp:attachment":[{"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=13676"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/categories?post=13676"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/tags?post=13676"},{"taxonomy":"content_type","embeddable":true,"href":"https:\/\/www.withsecure.com\/en\/wp-json\/wp\/v2\/content_type?post=13676"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}