Supply Chain Statistics

Cloud-related threats (40%), third-party breaches (34%), and ransomware (33%) rank after AI as major preparedness gaps.

Half of organisations are making changes to vendor, third-party, and supply chain risk management, while 49% are making changes to cyber insurance, incident response, and crisis management.

Six previously resolving MCP hostnames were unregistered and available for purchase for $4 to $12 per year.

21% of financial services organizations fully segment third-party access with enforced policy controls.

37% of security leaders cited "detecting more than we can fix" as their organization's single biggest obstacle to improving software supply chain security

54% of CVE instances observed in third-party production code come from CVEs published more than a year ago.

Small and midsize companies carry 414 unsanctioned AI tools per 1,000 employees.

79% of third-party applications are authorized.

31% of manufacturers affected by supplier cyber attacks reported delays to customer deliveries.

30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain.

DPRK-nexus adversaries injected malicious packages into AI frameworks, poisoning 131 trusted AI framework packages.

In 1H 2026, 87% of identified software registry threats involved malicious npm packages.

eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.

Organisations that knowingly work with risky suppliers are more than four times as likely to experience a supplier-originated cyber incident.

48% of organisations continue working with suppliers despite known resilience or security concerns.

26% of organisations identify dependence on suppliers as a main barrier to improving resilience.

Nearly a quarter (24%) of 17,651+ tracked Model Context Protocol (MCP) servers carry at least one vulnerability.

28.6% of 130,667 cataloged tools are classified as high risk.

38% of restaurant chains say reliance on third-party vendors increases their cyber risk.

62% of restaurant chains work with six or more third-party vendors per location.

28% of restaurant chains had third-party platform data exposed in the past year.

28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.

95% of universities have at least one vendor with embedded AI exposure.

Around 50% of universities have detectable third-party AI embedded in their services.

64 European organisations were drawn into a ransomware or data extortion incident through a third party.

Among organizations with confirmed AI-related security incidents, Shadow AI contributed to 44% of incidents, data or model poisoning 41%, improper output handling 41%, supply chain vulnerabilities 35%, and prompt injection 34%.

53% of the organisations drawn into third-party ransomware or data extortion incidents traced to a single event: the August 2025 compromise of Miljödata.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

63% of healthcare practices do not continuously monitor their digital supply chains.

38% of organizations in MEA report reliance on third-party ecosystems and vendors, increasing supply-chain blind spots.

33% of organizations identify third-party vendors as a major visibility gap.

16% of security professionals say supply chain and third-party risk is the boardroom cyber priority boards ask about most.

41% of cybersecurity professionals identify AI-powered attacks at scale as their biggest security concern, compared with 21% citing supply chain risk and 21% citing unknown threats.

70% of security leaders say their organizations apply risk controls only to key suppliers.

98% of security leaders are concerned about the risks of giving third-party AI-based systems, including large language models, access to company data.

79% of security leaders are concerned or very concerned that suppliers' and partners' AI tool use poses a cybersecurity risk to their organization.

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.