Supply Chain Statistics

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.

48% of organisations continue working with suppliers despite known resilience or security concerns.

26% of organisations identify dependence on suppliers as a main barrier to improving resilience.

89% of businesses assess supplier resilience at onboarding.

Organisations that knowingly work with risky suppliers are more than four times as likely to experience a supplier-originated cyber incident.

26% of businesses have suffered a cyber incident that originated in their supply chain in the last year.

43% of organisations that knowingly work with risky suppliers experienced a supplier-originated cyber incident, compared with 10% of organisations that did not knowingly work with risky suppliers.

61% of businesses assess supplier resilience on an annual, quarterly or continuous basis.

23% of organisations cite supply chain vulnerabilities as one of their top three challenges over the next five years.

Nearly a quarter (24%) of 17,651+ tracked Model Context Protocol (MCP) servers carry at least one vulnerability.

28.6% of 130,667 cataloged tools are classified as high risk.

38% of restaurant chains say reliance on third-party vendors increases their cyber risk.

62% of restaurant chains work with six or more third-party vendors per location.

28% of restaurant chains had third-party platform data exposed in the past year.

28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.

95% of universities have at least one vendor with embedded AI exposure.

Around 50% of universities have detectable third-party AI embedded in their services.

80% of higher education institutions share the same 11 vendors.

67% of suppliers are used by five or fewer higher education institutions.

64 European organisations were drawn into a ransomware or data extortion incident through a third party.

Among organizations with confirmed AI-related security incidents, Shadow AI contributed to 44% of incidents, data or model poisoning 41%, improper output handling 41%, supply chain vulnerabilities 35%, and prompt injection 34%.

53% of the organisations drawn into third-party ransomware or data extortion incidents traced to a single event: the August 2025 compromise of Miljödata.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

63% of healthcare practices do not continuously monitor their digital supply chains.

38% of organizations in MEA report reliance on third-party ecosystems and vendors, increasing supply-chain blind spots.

33% of organizations identify third-party vendors as a major visibility gap.

16% of security professionals say supply chain and third-party risk is the boardroom cyber priority boards ask about most.

41% of cybersecurity professionals identify AI-powered attacks at scale as their biggest security concern, compared with 21% citing supply chain risk and 21% citing unknown threats.

70% of security leaders say their organizations apply risk controls only to key suppliers.

98% of security leaders are concerned about the risks of giving third-party AI-based systems, including large language models, access to company data.

79% of security leaders are concerned or very concerned that suppliers' and partners' AI tool use poses a cybersecurity risk to their organization.

72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.

14% of Nordic CISOs cited supply chain as their primary concern.

49% of organizations include third-party applications in their current patching process.

74% of IT and security professionals have experienced vulnerabilities in third-party applications.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

56% of security leaders now experience cybersecurity-related downtime caused by SaaS and other third-party application issues often or very often, nearly triple the rate in 2024.

Of the 48,000+ CVEs published in 2025, only 58 represented a genuine, discoverable, and exploitable threat to enterprise supply chains.