24 February 2026

This article was written by Alberto Bonaventura, an Information Technology Audit Manager and Janaki Ramani, a Cyber Security & GRC Manager in their capacity as volunteers for UK Cyber Security Council who are experts in their field.

The Invisible Actors

Imagine yourself reading this article using your laptop, tablet or smartphone from your favourite coffee shop with “free” wi-fi. This common scenario hides a countless number of invisible actors and moving parts behind the scenes working to ensure this experience is seamless and secure. These include at least a

coffee/tea bean producer, reseller and distributor to serve our drink;
payment provider (coffee/tea is not for free) to pay our drink (and the wi-fi);
connection service provider to ensure access to internet;
cloud service provider storing and displaying this article in a static webpage.

From a security standpoint, with growing scale and velocity malicious actors constantly attempt to drop and run their malicious payloads exploiting weak spots such as unsecure endpoints, untrusty contractors, stressed employees or automated software updates.

When they succeed, the business consequences are monumental leading to loss of business, customer trust, intellectual property and talents. To give an example, the compromise of a third-party system account to Jaguar Land Rover (JLR) resulted in a five-weeks shutdown, a 27% fall in the UK car manufacturing and an estimated £ 1.9 bn economic loss [1].

In this context, security professionals play a critical role in translating technical language into business risks equipping boards with relevant information to prioritise investment, approve contingency plans, and set a realistic risk appetite.

Supply Chain and the UK

The supply chain can be thought as “a set of three or more entities (organizations or individuals) directly involved in the upstream and downstream flows of products, services, finances, and/or information from a source to a customer” [2].

This definition allows us to identify and explore cause and effects mechanisms systemic underlying common supply chain shocks and related risk mitigation strategies. In this section, we will explore 4 macro interrelated factors that only in part can explain the complexity:

geopolitical context
market concentration
security model
board preparedness

Geopolitical instability amplifies market concentration risk, concentrated markets increase systemic exposure, and weak security models magnify the impact of supplier failures. Prepared board members ultimately determine whether these risks are recognised early or only after disruption occurs. Understanding how these factors interact allows cybersecurity professionals to move beyond isolated controls and instead support informed, enterprise-level risk decisions.

Geopolitical Context

The US disengagement in Ukraine, the sweep changes in Syria and Venezuela, the unfolding situation in Iran and the pursuit of stable procurement of natural resources for national security have raised the global tension to unprecedented levels. In this highly unpredictable context, the supply chain has become a powerful vector of attack to carry out misinformation, espionage and cyberattacks campaigns. Unsurprisingly, the UK has become one of the main targets with an estimated cost £14.7 billion each year to business, equivalent to 0.5% of UK GDP [3].

In the Microsoft Digital Defence Report 2025, the UK figures as the second largest European country, after Ukraine, for number of observed nation-state attacks in Europe, and businesses impacted in the world [4]. In fact, in 2025 70% of UK businesses experienced more cyber-attacks compared to the previous year [5] followed by nearly £ 200 million in cyber claims with annual increase of +230% [6].

Small and medium-sized enterprise (SMEs) in particular, which account for nearly 99.85% [7] of the businesses, appear the weak link of the chain due to a general lack of adequate preparedness. This finds ground from some alarming indicators found in the “Cybersecurity breaches survey 2025” [8]:

40% of medium-sized businesses lack formal incident response plans.
68% of medium-sized business lack risk reviews of their immediate suppliers.

Market Concentration

Despite critical resources and cloud computing services have fostered business innovation reducing market barriers on the other hands their excessive concentration in the hands of nation-states and few corporations pose a systemic risk to service resilience. As an example, China is a leading country in the extraction of critical resources for semiconductors and microchips such as gallium (99%), indium (70%), rare earth elements (69%) and fluorspar (62%) [9]. On the other hand, the United States are heavy consumer of these resources to scale their AI infrastructure and consolidate their cloud service leadership domestically and abroad in the EU and UK where the cloud market is far from being competitive.

According to a report published by the Competition and Markets Authority (CMA) in 2025, AWS and Microsoft dominate the UK cloud computing market. Just in the infrastructure as a service (IaaS) space, both retain a market share between 70/90% [10]. This excessive concentration coupled with the geopolitical tensions pose UK business in a vulnerable position as seen with the recent wide system failures:

An empty DNS record for the AWS US-EAST-1 datacentre impacted banks like Lloyds and Halifax [11]
A similar DNS issue was in Microsoft Azure was responsible for websites outage at Heathrow and NatWest [12]

From a governance perspective, market concentration introduces a form of systemic third-party risk that cannot be fully mitigated through traditional vendor controls alone. Boards must recognise that resilience in highly concentrated markets depends on informed trade-offs, such as tolerance for downtime, exit feasibility, and dependency transparency. Cybersecurity leaders can support this by mapping critical services to dominant providers and clearly articulating the business impact should those services fail simultaneously across the market.

Security Models

Traditional perimeter-based security (Castle-and-Moat) models are no longer sustainable to keep up with the rapid evolution of the threat landscape and the pervasive dependency on third-party components. These models in fact define their defence posture with a combination of layered defence solutions (IDS/IPS, Firewalls, …) aimed at protecting internal network resources from external threats. However, the heavy reliance on third-party service dependencies components (e.g. third-party libraries, APIs, third-party accounts) has made this security approach unable to protect the networks from within because they assume trust within the corporate environment.

Conversely, zero trust framework (ZTF) does not assume trustworthy relationships within the corporate network but request continuous verification of network services and devices placed within the corporate network according to the principle of “never trust, always verify.”

To mitigate supply chain risks, cybersecurity professionals can protect their organizations factoring these principles in their Third-Party Risk Management (TPRM) programs via

secure access controls with minimum access to resources;
networks segmentation policies to restrict access of third parties to certain areas and contain their impact in case of breach;
continuous monitoring and authentication to detect malicious activities and prevent unauthorised access.

Importantly, these controls do not eliminate risk entirely, but to reduce uncertainty and limit blast radius when failures occur. For Boards, this distinction is critical. A mature security model enables leadership to understand which supplier failures are survivable, which require contingency planning, and where investment delivers the greatest reduction in business impact. This shifts cyber discussions from technical assurance to operational resilience.

Board Awareness

Board of directors lack sufficient expertise in technology domains to make informed decisions. This deficit can ultimately result in uninformed decisions with impact to cyber resilience preparedness. A survey by RSM UK found that ~33% of middle market businesses have admitted that their board lack sufficient understanding of the cyber threat landscape [13]. To make things worse, recent research conducted by the NCSC found that 80% leaders were unsure whether the accountability for security resides on boards or CISOs (or equivalent roles) [14].

At this point security leaders can play a critical role in translating technical risks into business language free from technical jargon. The newly published NIST IR 8286 Revision 1 highlights the importance of integrating cybersecurity into the enterprise risk management (ERM) to support informed enterprise-level decision making. In particular, the updated standard mentions the expressions “translating cybersecurity into ERM” with the purpose to make information clear and understandable and suited to the recipient [15].

Conclusion

Cyber supply chain risk exists because modern organisations rely heavily on external technology providers such as cloud services, software vendors, and managed service providers to deliver critical business services.

As organisations become more digital and interconnected, cyber risk increasingly extends beyond organisational boundaries to suppliers that are not directly controlled.

A cyber incident affecting a single supplier can quickly cascade across multiple organisations, disrupting services and exposing sensitive data, with financial, regulatory, and reputational consequences. Recent supply chain attacks and operational failures have shown that security controls focused only on internal environments are insufficient when critical services depend on third parties.

In response, organisations apply monitoring, assurance, and contractual controls in proportion to supplier risk, enabling executives and boards to understand key dependencies and the resulting business impact.

References

[1] Jaguar Land Rover cyber attack caused UK car production to slump by a quarter - BBC News

[2] Mentzer, J. T. et al. (2001) ‘Defining Supply Chain Management’, Journal of Business Logistics, 22(2), pp. 1–25

[3] Summary of research on the economic impact of cyber attacks - GOV.UK

[4] Microsoft Digital Defence Report 2025

[5] Hiscox Cyber Readiness Report 2025 | Hiscox UK

[6] Nearly £200 million paid in cyber claims to help UK businesses recover | ABI

[7] Business population estimates for the UK and regions 2025: statistical release - GOV.UK

[8] Cyber security breaches survey 2025 - GOV.UK

[9] Key Minerals in Data Centers Infographic | U.S. Geological Survey

[10] Summary of final decision

[11] Amazon reveals cause of AWS outage that took everything from banks to smart beds offline | Amazon | The Guardian

[12] Microsoft Azure outage: Websites come back online - BBC News

[13] 1 in 3 middle market businesses don't understand cyber threat | RSM UK

[14] How to talk to board members about cyber - NCSC.GOV.UK

[15] IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management (ERM) | CSRC