One in 4 businesses (26%) have suffered a cyber incident that originated in their supply chain over the last year. This is despite organizations being highly aware of the risk facing them, with nearly half (48%) stating they have continued working with suppliers despite known resilience or security concerns.
The findings come from the “Data Health Check 2026,” an annual survey of 500 IT decision-makers, which also revealed that in many cases organizations lack viable alternatives: more than a quarter (26%) identified “dependence on suppliers” as a main barrier to improving resilience.
Other key findings from the research include:
- Almost 9 in 10 businesses (89%) assess supplier resilience at onboarding, and the majority (61%) assess supplier resilience on an annual, quarterly or continuous basis.
- “Supply chain vulnerabilities” was also identified as one of the top three challenges facing organizations over the next five years, cited by 23% of respondents. This is behind only AI-driven cyber threats (46%) and ransomware (26%).
- Organizations that knowingly work with risky suppliers were more than four times as likely to experience a supplier-originated cyber incident. 43% of those organizations experienced an incident, compared with 10% of those that did not knowingly work with risky suppliers.
“This year’s findings indicate that supply chain resilience remains a critical pain point for many businesses, which the majority are aware of and which continues to be exploited by attackers. When something goes wrong at a key supplier, the cascade effects can be profound for businesses throughout the chain. Despite good intentions around assessing supplier resilience, most companies don’t fully understand the depth of complexity in their supply chains. Often they’ll know who their core suppliers are, but beyond that, visibility drops away,” said Chris Butler, resilience director at Databarracks. “The traditional approach to assessment has long been tick-box based, with compliance questionnaires growing longer every year. This approach creates a false sense of assurance rather than real resilience. To truly manage your supply chain continuity, it’s vital to actually get visibility of the situation. Business leaders need to treat supplier resilience as part of their own resilience, not somebody else’s problem. It’s a bit of a cliché but for good reason: you really need to treat your critical suppliers like you would your own business. Where there isn’t a viable alternative and your existing suppliers don’t have in-house business continuity skills, offer to help. Include your suppliers in your business continuity exercises and give them the chance to rehearse with you. It’s important to practice the response to disruption together rather than in isolation. Doing this will benefit you in the long run.”
