99% of Global 2000 Companies Directly Connected to a Supply Chain Breach

20% of these megacompanies use a thousand or more products

99% of Global 2000 Companies Directly Connected to a Supply Chain Breach

Allison Knight
10Fold for SecurityScorecard
securityscorecard@10fold.com

BLACK HAT 2024 – New research from SecurityScorecard and The Cyentia Institute identified 99% of Global 2000 companies are directly connected to vendors that have had recent breaches. Prompted by new SEC cybersecurity requirements demanding transparency around third-party breaches, this report highlights the escalating risk of multi-party supply chain attacks.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240805219183/en/

(Graphic: Business Wire)

The interconnected nature of modern business means that a vulnerability in one part of the supply chain can have far-reaching consequences, potentially impacting the entire ecosystem. Massive third-party incidents like Change Healthcare, MOVEit, and SolarWinds underscore the critical need for robust supply chain cybersecurity.

Key Findings: Global 2000: Industry Titans Battle the Beast of Supply Chain Cyber Risk

99% of Global 2000 companies are directly connected to a supply chain breach.
20% of these megacompanies use a thousand or more products.
Supply chain incidents cost 17X more to remediate and manage than first-party breaches.
The estimated total losses from Global 2000 breaches ranged between $20 billion and $80 billion over 15 months.
Global 2000 companies face significant concentrated risk due to their interdependence, with 90% acting as vendors to each other.
The top 8 most widely deployed vendors are used by at least 80% of Global 2000 companies, with 4 of the top 5 reporting a recent breach.

Wade Baker, partner and co-founder at The Cyentia Institute, said: “While the Global 2000 boasts $51.7 trillion in revenue, their interconnectedness exposes them to severe cyber risks – with 99% directly connected to breached vendors and incidents that can tally into the tens of billions.”

Know Your Supply Chain

Whether caused by a malicious DDoS attack or a faulty patch update, the end result of a supply chain event is the same: Users are denied access to critical systems.

Knowing Your Supply Chain (KYSC) is becoming an increasingly important component of cyber resilience. Understanding the dependencies within your organization and those of your vendors is critical for responding to incidents effectively. Even the most reliable vendors and partners can experience issues.

Key steps to securing the supply chain include:

Continuously monitor the external attack surface: Safeguard your IT ecosystem with continuous automated scanning. Identify and mitigate IT infrastructure and cybersecurity risks across vendor, agency, and partner environments.
Identify single points of failure: Map the critical business processes and technologies to identify any single points of failure. Create a watch list with these vendors.
Automatically detect new vendors: Passively monitors vendors’ IT deployments to identify and resolve hidden supply chain risk.

Ryan Sherstobitoff, Senior Vice President of Threat Research and Intelligence, said: “The world is only beginning to grasp the potential for chaos caused by concentration risk. Understanding and managing your supply chain is critical to protect business continuity. It's not just about preventing disruptions; it’s about safeguarding the very foundation of our interconnected economy.”

Methodology

The Forbes Global 2000 ranks the largest companies in the world using four metrics: sales, profits, assets, and market value. The 2024 list accounts for $51.7 trillion in revenue, $4.5 trillion in profits, $238 trillion in assets, and $88 trillion in market value. The analysis focused directly on the security posture and breach history of the Global 2000 and the ecosystem of third-party vendors surrounding each Global 2000 company to understand the nature of cyber risk across their supply chains.

The data on third-party relationships comes from SecurityScorecard’s Automatic Vendor Detection capability. Automatic Vendor Detection identifies vendors and products that make up the digital supply chain of modern organizations.

SecurityScorecard continuously scans the internet to identify vulnerable and misconfigured digital assets. Additionally, SecurityScorecard monitors signals across the Internet, relying on a global network of sensors that spans the Americas, Asia, and Europe. The company operates one of the world’s largest networks of sinkholes and honeypots to capture malicious signals and further enrich its data set by leveraging commercial and open-source intelligence sources.

Additional resources

Download the Global 2000: Industry Titans Battle the Beast of Supply Chain Cyber Risk Report.
SecurityScorecard was named a Leader in the Forrester Wave.
To learn more about SecurityScorecard Supply Chain Risk Intelligence, visit our website and stop by Booth #2830 at Black Hat USA August 5-8.

About SecurityScorecard

Funded by world-class investors, including Evolution Equity Partners, Silver Lake Partners, Sequoia Capital, GV, Riverwood Capital, and others, SecurityScorecard is the global leader in cybersecurity ratings, with more than 12 million companies continuously rated.

Founded in 2013 by security and risk experts Dr. Aleksandr Yampolskiy and Sam Kassoumeh, SecurityScorecard’s patented security ratings technology is used by over 25,000 organizations for enterprise risk management, third-party risk management, board reporting, due diligence, cyber insurance underwriting, and regulatory oversight.

SecurityScorecard achieved the Federal Risk and Authorization Management Program (FedRAMP) Ready designation, highlighting the company’s robust security standards to protect customer information, and is listed as a free cyber tool and service by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Every organization has the universal right to its trusted and transparent Instant SecurityScorecard rating. For more information, visit securityscorecard.com or connect with us on LinkedIn.