The supply chain is the weakest link

This is the third of six posts drawn from Concordia on 1 October, where our Managing Director, Yogesh Agarwal, opened the day with six things we keep seeing in our work with clients. Last week we looked at the rise of the bots. This week: supply chain cyber risk, and why doing everything right is not always enough.

In September 2025, Jaguar Land Rover was the target of a criminal cyber attack that halted production for weeks. Analysts later put the cost to the UK economy at £1.9 billion, with more than 5,000 organisations affected, and the government guaranteed a £1.5 billion loan to help keep the supply chain trading.

Almost none of those 5,000 organisations were attacked themselves. They were suppliers and customers of a company that was, and the disruption reached them regardless of how good their own security happened to be. The lesson there is not about any one company's controls. It is about how far the effects travel once something starts.

That is the part Yogesh kept returning to at Concordia. Organisations have got better at their own security. You hold the certifications, you have mapped your controls, and you have good reason to think you have done a decent job. Then someone with access somewhere into your network has a bad week, and the effects reach you anyway.

What we are seeing in supply chain cyber risk

Third parties are now involved in nearly half of breaches. Supply chain related breaches account for 48% of the total, and rose by 60% in a year. The attacker does not need a way into you if they have a way into someone you have already let in.

One supplier can stop an entire industry. In September 2025, an attack on one check-in supplier disrupted airports including Heathrow, Brussels and Berlin at the same time. Each of those airports had its own security programme. None of that mattered, because they shared one supplier.

Most organisations have not looked yet. Just 15% of UK businesses review the cyber security risks posed by their immediate suppliers, and only 6% look at the wider supply chain beyond that. So the risk behind nearly half of breaches is also the one with the most ground still to cover, which is good news in one sense: a focused piece of work goes a long way here.

Doing everything right is not enough

None of the work you have already done is wasted. Hardening the perimeter, training the staff and certifying the controls all reduce risk, and they are the right things to have done. They share one assumption, which is that the organisation controls its own outcome.

Supply chain risk is the part that sits outside that. Some of your exposure comes from arrangements inside other organisations, which you cannot see in full and cannot put right directly. What you can do is find out where it sits, and agree in advance what happens if one of them goes down. That is a short and practical piece of work, and it is the part most organisations have not got to yet.

The firms that came through that period best were not the ones with the best security. They were the ones who already knew which supplier mattered, and had somewhere else to go.

Yogesh left the room with one question to take back to their own organisations.

“Are there any suppliers that would lead to a complete stoppage of business if they were not available, or even if they had access to your network?”

Yogesh Agarwal, Managing Director, RightCue, speaking at Concordia

There are two questions in there, and the second one is the one that usually gets missed. Availability is the obvious risk, and it is the one that makes the headlines. Access is the quieter one. A supplier with a live connection into your systems is part of your attack surface whether or not they ever go down, and that connection was often set up years ago by someone who has since left.

You are also somebody's supplier

Everything above describes the problem looking down your own supply chain. It is worth turning it round, because the same pressure that has boards asking their suppliers for evidence makes you the supplier in somebody else's version of this exercise.

That is how supplier assurance actually arrives for most organisations. Not as a risk programme anyone chose to run, but as a questionnaire from a customer, with a renewal date attached and a procurement team on the other end who will not sign without it. The organisations that find this painful are the ones answering it from scratch every time. The ones that find it straightforward already hold the certificate, the policies and the evidence in one place, which is much of the practical value of an ISO 27001 management system.

What is coming

Managed service providers are being brought into regulation. The Cyber Security and Resilience Bill extends the existing rules to cover managed service providers, on the reasoning that a supplier with privileged access to hundreds of client networks is critical infrastructure in practice, whatever it is called on paper. It also brings in a 24 hour initial notification and a fuller report within 72 hours, and requires managed service providers to tell their customers when those customers are likely to have been affected. Those timescales arrive through secondary legislation rather than on day one, so they are not operational yet, but the direction is set.

Ministers have asked boards to require Cyber Essentials across their supply chains. In an October 2025 letter to the CEOs and chairs of leading UK companies, ministers and the heads of the NCSC and the National Crime Agency asked boards to embed the same requirements government already places on its own suppliers. The letter pointed out that only 14% of UK businesses were assessing the risks posed by their immediate suppliers. We are an IASME Certification Body for Cyber Essentials and Cyber Essentials Plus.

Defence has already moved. Defence Cyber Certification is becoming the standard for suppliers to the MOD, with Level 0 mandated for industry partners by the end of 2026. Where defence goes on supplier assurance, regulated sectors tend to follow.

Where we would start

None of this needs new budget or a procurement transformation programme, which matters, because supplier assurance usually lands on someone who already has a full-time job. These are the practical steps we recommend to clients, and the first few are where our supply chain security work usually begins:

• Decide who owns it. Procurement holds the contract, IT holds the connection and the business holds the relationship. Supplier risk sits across all three, so it helps to name an owner early, even where the work itself stays shared.
• Rank suppliers by disruption, not by spend. The supplier that could stop you is rarely the one you pay the most. It is often a small firm holding one integration, one licence or one set of credentials. Ranking them is part of IT risk management rather than a separate exercise.
• Ask for evidence rather than assurances. A Cyber Essentials certificate has a number on it and can be checked. "We take security seriously" cannot. For a supplier who could genuinely stop you, Cyber Essentials Plus is the stronger ask, because the controls are tested by an assessor rather than self-declared.
• Find your single points of failure. Where do several parts of the business, or several of your own suppliers, depend on the same provider? That is the airports problem in miniature.
• Decide now what happens when one goes down. Who do you call, what do you switch to, how long can you run without them. Deciding this during an incident costs days you do not have, which is the case for running a cyber incident response exercise that includes a supplier failure.
• Put it in the contract at renewal. Certification, notification timescales and the right to ask questions are far easier to agree before you sign than after something goes wrong.
• Ask who your suppliers depend on. Your fourth parties are someone else's third parties, and they rarely appear in anyone's review. Asking the question of your most critical suppliers is usually enough to start with.