Supply Chain Statistics

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

DPRK-nexus adversaries injected malicious packages into AI frameworks, poisoning 131 trusted AI framework packages.

In 1H 2026, 87% of identified software registry threats involved malicious npm packages.

eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.

48% of organisations continue working with suppliers despite known resilience or security concerns.

26% of organisations identify dependence on suppliers as a main barrier to improving resilience.

89% of businesses assess supplier resilience at onboarding.

Nearly a quarter (24%) of 17,651+ tracked Model Context Protocol (MCP) servers carry at least one vulnerability.

28.6% of 130,667 cataloged tools are classified as high risk.

38% of restaurant chains say reliance on third-party vendors increases their cyber risk.

62% of restaurant chains work with six or more third-party vendors per location.

28% of restaurant chains had third-party platform data exposed in the past year.

28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.

95% of universities have at least one vendor with embedded AI exposure.

Around 50% of universities have detectable third-party AI embedded in their services.

64 European organisations were drawn into a ransomware or data extortion incident through a third party.

Among organizations with confirmed AI-related security incidents, Shadow AI contributed to 44% of incidents, data or model poisoning 41%, improper output handling 41%, supply chain vulnerabilities 35%, and prompt injection 34%.

53% of the organisations drawn into third-party ransomware or data extortion incidents traced to a single event: the August 2025 compromise of Miljödata.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

63% of healthcare practices do not continuously monitor their digital supply chains.

38% of organizations in MEA report reliance on third-party ecosystems and vendors, increasing supply-chain blind spots.

33% of organizations identify third-party vendors as a major visibility gap.

16% of security professionals say supply chain and third-party risk is the boardroom cyber priority boards ask about most.

41% of cybersecurity professionals identify AI-powered attacks at scale as their biggest security concern, compared with 21% citing supply chain risk and 21% citing unknown threats.

70% of security leaders say their organizations apply risk controls only to key suppliers.

98% of security leaders are concerned about the risks of giving third-party AI-based systems, including large language models, access to company data.

79% of security leaders are concerned or very concerned that suppliers' and partners' AI tool use poses a cybersecurity risk to their organization.

72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.

14% of Nordic CISOs cited supply chain as their primary concern.

49% of organizations include third-party applications in their current patching process.

74% of IT and security professionals have experienced vulnerabilities in third-party applications.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

56% of security leaders now experience cybersecurity-related downtime caused by SaaS and other third-party application issues often or very often, nearly triple the rate in 2024.

Of the 48,000+ CVEs published in 2025, only 58 represented a genuine, discoverable, and exploitable threat to enterprise supply chains.

PRESSURE CHOLLIMA conducted the largest financial theft ever reported: $1.46 billion in cryptocurrency via a trojanized supply chain compromise.

56% of organizations use embedded AI within third-party vendor tools that employees often do not recognize as using AI.

80% of enterprises were not prepared to meet software supply chain security requirements in 2024.

Third-party involvement occurs in 30% of financial-sector breaches.