A week ago, world-renowned apparel and footwear brand Adidas announced to its customers that their data might be exposed, revealing that one of its third-party vendors suffered a data breach.
What does this mean?
Despite having the best tools, resources, and people organizations can still become targeted by a cyber attack.
When a cybercriminal targets one of their third-party service providers or vendors.
Therefore, it is essential to proactively assess and manage third-party risks before they get exploited by a cybercriminal to carry out a cyber attack.
Let us explore how cybercriminals carry out supply chain attacks, the threats/risks that they pose, and some third-party risk management best practices
What are third party risks? What makes supply chain attacks more dangerous?
As an organization expands in size and its services, it must rely on multiple third-party vendors to meet its needs. For example, an organization depends on several logistics companies to facilitate international logistics.
Any unassessed or hidden security risks within a third-party’s infrastructure can be exploited by cybercriminals to orchestrate a cyber attack.
What makes supply chain attacks more dangerous is that, unlike any other attack that targets a single organization, they can come from any direction, impacting multiple organizations.
Some of the biggest breaches in history, like the attack on Change Healthcare, with cybercriminals stealing 6TB of patient data, were orchestrated through the exploitation of third-party security weaknesses.
According to Verizon’s Data Breach Investigations Report 2025, the number of supply chain attacks has doubled (from 15% to 30%) since last year.
How does a supply chain attack look like?
Here is how a typical supply chain attack looks like:
What is Third Party Risk Management TPRM? Why is important?
Third-party risk management is a systematic way to proactively identify and address third-party risks by proactively analyzing, detecting, identifying, addressing, and monitoring risks associated with outsourced party vendors.
An organization without any third-party risk management in place can be exposed to an increased risk of:
- Strategic failures
- Operational disruption
- Non-compliance and legal consequences
- Financial damage
- Reputational loss
The benefits of risk management
The following are the benefits of risk management:
- Provides the necessary direction and clarity for proactively addressing risks
- Saves time and resources otherwise spent on responding to third-party attacks
- Offers security context to vendors
- Saves from costs associated with data breaches
- Improves data security, ensuring the integrity and availability of data
- Enhances focus on business
Some effective ways to manage third party security risks
Here are some effective ways to manage third-party risks:
Develop a security-centric vendor onboarding process
Onboarding new vendors means onboarding their risks too. Establish a security rating process based on risk assessment where vendors are shortlisted and onboarded based on their security rating.
Monitor vendors for risks
Continuously monitor all the vendors for security risks. Deploy an external surface monitoring solution to monitor third-party risks in real-time.
Create and enforce vendor risk management program
Enforce a vendor risk management program that detects data leaks and addresses risks at each stage of the vendor risk lifecycle.
Minimize the vendor access to sensitive data
Use a Privileged Access Management policy to ensure that vendors have minimal access to sensitive data.
Segment networks
Segmentation of networks makes it challenging for cybercriminals to move laterally and access sensitive assets.
Enforce MFA across organization
It can reduce the possibility of unauthorized access by making it challenging for hackers to break into an account.
Deploy honeypots
Set up local honeypots to catch intruders trying to access sensitive data.
Measure the effectiveness of third-party risk management
Periodically measure the effectiveness of the third-party risk management program through pentesting.
