Supply chain security: Testing and managing third-party risk.
You are only as secure as your weakest vendor. Third-party compromise now accounts for 60% of enterprise breaches.
When SolarWinds got compromised, attackers did not breach SolarWinds' customers directly. They compromised SolarWinds first, then shipped malware to thousands of customers inside a software update. Supply chain compromise is now a primary attack vector: get access to a trusted vendor, and you get access to all their customers.
Managing third-party risk means knowing what vendors can access in your environment, what data they can see, and whether they actually need that level of access. Many vendors have standing access to production systems they no longer need. Some have keys to your data because they needed them during implementation and never revoked them. Supply chain security starts with inventory: what vendors do you trust with critical systems? And do you trust them with that level of access?
The organizations reducing third-party risk fastest are the ones segmenting vendor access: VPN only to specific systems, API keys scoped to specific resources, accounts that lock down after 90 days and require justification to renew. Testing vendor security posture through security questionnaires and audits is table stakes. Validating that they can actually execute on their security commitments requires technical assessment.