Webbit
Supply Chain Attacks and Vendor Risk: How to Check Your Suppliers in 2027
Your suppliers' security is part of yours. A practical, small-team method to list, rank and review vendors, with contract points and questions to ask.
Think about everyone who can touch your business: the accountant with your financial data, the agency that edits your website, the payroll provider, the cloud platform, the freelancer with admin rights, the software library inside your app. Each of them is a door. A criminal who can't get through yours may try theirs.
The evidence
Verizon's 2026 Data Breach Investigations Report found third-party involvement in about 48% of breaches, a rise of roughly 60% year on year, and found that many third parties hadn't fixed missing or weak multi-factor settings on cloud accounts, as summarised by Help Net Security. Secondary summaries differ a little on the figures, so read the report before quoting them.
The Jaguar Land Rover attack in 2025 shows the other side. A production halt of about six weeks hit more than 5,000 organisations, and the Cyber Monitoring Centre put the cost to the UK economy at roughly £1.9 billion, according to Cybersecurity Dive. Many of the businesses harmed weren't the target. They simply sold to or bought from someone who was.
Four ways supply chains fail
| Type | Example | What helps |
|---|
| Supplier is breached | A provider you trust loses your data | Share less, and ask what they protect and how |
| Supplier's access is abused | Their login is used to reach your systems | Scoped access, multi-factor sign-in and quick offboarding |
| Software dependency is poisoned | A library or plugin you use is tampered with | Pin versions, monitor updates, and remove what you don't need |
| Supplier goes down | An outage halts your own operations | Know your dependencies and have a fallback |
A simple five-step review
- List every supplier, tool and agency that holds your data or has access to your systems. Check your finance records, your single sign-on list and your website admin users.
- Tier them. Tier one can cause serious damage if they fail or are breached. Tier three is low risk.
- Check tier one properly. Ask for evidence, not promises.
- Give tiers two and three a lighter check, usually a short questionnaire and a review of their access.
- Repeat yearly, and whenever a supplier changes or something goes wrong.
Questions to ask a tier-one supplier
- Do you use multi-factor sign-in for staff and for the accounts that reach our data?
- How do you restrict who in your company can see our data?
- When did you last test your security, and can we see a summary?
- How quickly do you patch serious flaws?
- How and when will you tell us about a breach?
- Where is our data stored, and who are your own subcontractors?
- What happens to our data when we leave?
Look for specific answers. "We take security very seriously" is a slogan. "We enforce multi-factor sign-in for all staff and have a 72-hour patching target for critical flaws" is an answer.
What to put in contracts
- A duty to report a breach within a set time, and to cooperate with your response.
- Limits on how your data may be used and where it may be stored.
- The right to see evidence of security controls or testing.
- Rules for subcontractors.
- Clear data return and deletion at the end of the contract.
Offboarding is the step most firms miss. When an agency, freelancer or tool leaves, remove their accounts, rotate shared passwords and revoke connected apps on the same day. Old access is a common way in.
Don't forget the rules that are arriving
If you sell software or connected products, the EU Cyber Resilience Act has required vulnerability reporting since 11 September 2026, with full requirements applying from 11 December 2027, per Ireland's NCSC. In India, the DPDP Rules keep you responsible for personal data your processors handle, which makes vendor checks a legal matter, not only a security one. See our DPDP checklist.
Pair this with the small business cybersecurity checklist, and see the ransomware guide for how supplier problems turn into outages. For the bigger picture, read the 2027 cybersecurity trends.
Tiering examples
| Tier | Examples | Depth of review |
|---|
| One: serious damage if breached or down | Cloud platform, email provider, payroll, accounting firm, your website developer, payment processor | Evidence, access review and a named contact |
| Two: moderate impact | CRM, marketing tools, project software, a freelance designer with file access | Short questionnaire and an access check |
| Three: low impact | Tools with no customer data or system access | Basic checks, reviewed every year or two |
Software dependencies in plain English
Most websites and apps are built from third-party pieces: libraries, plugins, themes and frameworks. Attackers sometimes tamper with a popular component, or take over an abandoned one. A business without developers can still do a few things:
- Keep a list of the plugins, apps and integrations your website and tools use.
- Remove anything unused, and anything that's no longer maintained.
- Apply updates promptly, ideally on a test copy first.
- Ask software suppliers whether they keep a software bill of materials, which is a list of the components in their product.
- Prefer suppliers that publish security fixes and tell customers when they happen.
When a supplier is breached: your first-day checklist
- Find out what the supplier held of yours and what was accessed.
- Change passwords and revoke API keys and tokens linked to that supplier.
- Check your own systems for strange activity from the supplier's accounts.
- Look at your legal duties: if personal data was involved you may need to notify regulators and people.
- Decide what to tell customers, and whether to pause any shared processes.
- Ask the supplier for a written account of what happened and what they've changed.
A short message to send a supplier
Keep it simple. For example: "We're reviewing the security of the suppliers who handle our data. Please tell us whether you use multi-factor sign-in for staff, how quickly you patch serious flaws, when you last tested your security and how you'll notify us of an incident. A short written answer is fine, and a summary of a recent test or certificate would help."
Know who can reach your business
Webbit can map the suppliers, tools and integrations connected to your systems, check how they are set up and give you a ranked list of what to tighten. It's a good first project for a business that has grown quickly and lost track of who has access to what. Book a free consultation and we'll suggest where to start, or see our cybersecurity services.
Frequently asked questions
What is a supply chain attack?
An attack that reaches you through a supplier, a software provider or a component you use, instead of attacking you directly. A weakness at one trusted vendor can affect many customers.
How many suppliers should we review in depth?
Start with the ten that hold the most sensitive data or have the deepest access. Give the rest a light check, and revisit the list every year.
Are small suppliers riskier than big ones?
Not always. Large providers are bigger targets but usually have more resources. Check each on its own evidence, such as access controls, testing and how it handles incidents.
Do we need a security questionnaire for every vendor?
No. Use a full review for high-risk vendors and a short form for low-risk ones. A short, focused set of questions with evidence beats a long form nobody reads.
Home · Blog · Book a Free Consultation