Third party security risks have become unmanageable according to the majority of cybersecurity experts.

Research which questioned cybersecurity leaders in the UK and USA found 60% admitted that security risks originating from third parties and supply chain partners are “innumerable and unmanageable”.

The concerns were part of the latest The State of Information Security Report from IO which revealed a growing disparity between cybersecurity confidence and reality.

In all 97% of cybersecurity leaders said they were confident in their breach response, with 61 per cent describing themselves as “very confident.” Yet, that confidence contrasts drastically with 61 per cent of leaders who noted their organisation had suffered a third-party or supply chain attack in the past 12 months. This further exemplifies the widening “confidence gap”, as business leaders back their resilience while supply chain compromises continue to cause widespread damage.

Recent high-profile incidents, such as the Jaguar Land Rover attack, which disrupted production across multiple manufacturing plants, and the Collins Aerospace attack on its MUSE software which grounded several European airports to a halt, highlight how supply chain compromises can quickly cascade far beyond their initial target, the report cautioned.

Among those who suffered a third-party or supply chain attack, 38% resulted in customer, employee or partner data breaches, 35% suffered financial losses or unplanned costs (e.g. remediation, fines, legal fees), and 33% faced temporary system outage or operational disruption. More than a third (36%) of organisations that suffered a customer data breach said they had experienced customer or partner churn or loss of trust as a result, while 28% faced heightened scrutiny from partners or suppliers.

“Cybersecurity leaders clearly recognise the importance of supply chain security, but many still underestimate how complex and interdependent modern supply networks have become,” said Chris Newton-Smith, CEO of IO. “This confidence needs to be matched by continuous action to avoid the domino effect across networks, impacting customer trust, finances, and operations.”

Despite the growing risk, only 23% of all respondents ranked supply chain compromise among their top emerging threats, placing it below AI misuse, misinformation, and phishing. This suggests that while investment is rising, supply chain risk is still underestimated relative to its potential impact.

While this year’s report focuses on the broader supply chain, it still underscores the disproportionate vulnerability of small and mid-sized businesses. Of those cybersecurity leaders within SMEs with up to 49 employees, 28 per cent reported supply chain disruption or cascading partner issues following a customer data breach, compared with 21 per cent of large enterprises. This suggests smaller firms are less able to contain the fallout of third-party incidents, often due to limited resources, smaller security teams, and fewer formal risk processes.

“Attackers increasingly see smaller suppliers as soft entry points into larger targets,” added Newton-Smith. “They may not be the ultimate prize, but they’re often the route into the larger organisations. Securing the entire supply chain is essential for national and commercial resilience.”

Recent high-profile incidents, such as the Jaguar Land Rover attack, which disrupted production across multiple manufacturing plants, and the Collins Aerospace attack on its MUSE software which grounded several European airports to a halt, highlight how supply chain compromises can quickly cascade far beyond their initial target, the report cautioned.