A big majority of organisations were negatively impacted by a supply chain cyber breach over the past 12 months, each suffering 3,7 breaches on average.
This is among the findings of BlueVoyant’s fifth annual global survey into supply chain cyber risk management.
The 2024 study demonstrates progress in third-party risk management (TPRM) as respondents shifted focus from TPRM awareness and adoption to enforcement and compliance. Results also highlight ongoing investment in technology and talent to enhance supply chain security.
This year’s survey found that 81% of organisations reported negative impacts from supply chain breaches over the past year, down from 94% in 2023. While this is a marked improvement, the vast majority of organisations are still reporting breaches.
“More organisations than any previous year indicated that their primary focus is no longer on awareness of the third-party risk management problem or adoption of a program, but rather with the operational, day-to-day challenges of managing an effective program,” says Joel Molinoff, global head of supply chain defense at BlueVoyant.
“While this progress also brings many new challenges, it indicates a major step in the right direction when contrasted with previous years where many organisations had poor tracking of third-party vendors, little to no leadership oversight, and virtually no collaboration when it came to remediating cyber issues.”
Despite budget increases and greater collaboration with suppliers, organisations still struggle to combat supply chain threats. Key data points observed in the report include:
- Increased budget and resources: 86% of respondents say TPRM budgets have increased.
- Increased collaboration with suppliers: More than 36% of organisations – up from 19% in the prior year – say they have pursued a far more active role in working with their suppliers each step of the way to ensure remediation of identified cyber risks.
- Intense difficulty in healthcare: Of the six sectors evaluated in the survey, healthcare and pharmaceutical companies reported the highest rate (87%) of being negatively impacted by a breach in their third-party ecosystem over the last twelve months. More than a third of healthcare organizations (36%) reported having no means to detect threats in third parties, also the highest rate across industries.
- Monitoring and periodic vendor assessment need to take a higher priority: Only 32% of third-party vendors are reported to be regularly monitored (1,459 suppliers out of a total of 4,510 on average in this survey). At the same time, 50% of organizations say they do not periodically assess all their vendors because of challenges related to resources, technology, and expertise.
“Organisations are making progress in more frequent monitoring of third parties, though challenges in reporting metrics to senior management persist,” says Brendan Conlon, global director of supply chain defense at BlueVoyant.
“As information security as an industry continues to mature, there will be more focus on the tighter integration of multiple aspects of security operations. This means that third-party cyber risk will inevitably be folded into day-to-day SOC operations and wider risk management programs.”
The study was carried out by an independent market research organisation, Opinion Matters, polling 2 100 C-suite leaders responsible for supply chain and cyber risk management across a range of industries. It was conducted in 11 countries across North America, Europe and Asia Pacific.