Supply chain attack, one compromise, many victims

Software supply chain.Malicious code is introduced into something you install — a vendor's product update, a build pipeline, an open-source package or a dependency several layers down. The signature is that the malicious artefact arrives correctly signed through a trusted channel.

Service provider compromise. An attacker breaches a managed service provider, support tool or identity platform and uses the legitimate access it holds to reach its customers. Nothing is tampered with; the existing privileges are simply used by someone else.

Data held elsewhere. No access to your systems is needed at all — the data was already at a supplier, and the supplier was breached. This is the most common of the three and the least often modelled.

Assessment alone does not, because a supplier that passed a review in March can be compromised in July. What reduces exposure is limiting what a compromised supplier can reach: least-privilege integrations, scoped API credentials that are rotated, network segmentation, and refusing standing administrative access where just-in-time access will do.

Alongside that sits knowing the chain — a software bill of materials for what you build and buy, fourth-party mapping for critical services — and detecting change early through continuous monitoring. Finally, rehearse the response: a supplier breach handled well and a supplier breach handled badly differ mainly in whether anyone had thought about it beforehand.