Adrian Johnson
TLDR:
- SecurityScorecard and McKinsey & Company report reveals a rise in cyber risks targeting third-party vulnerabilities.
- The study highlights a significant concentration of cyber risk in only 15 vendors, posing threats to national security and the global economy.
SecurityScorecard, in association with McKinsey & Company, has released a report titled “2024 Redefining Resilience: Concentrated Cyber Risk in a Global Economy Research”, which exposes a sharp increase in cyber risks targeting third-party vulnerabilities. The research shows that a mere 150 companies make up 90% of the technology products and services across the global attack surface, with 41% of them having evidence of compromised devices. Shockingly, 62% of the global external attack surface is concentrated in the products and services of just 15 vendors, who have below-average risk ratings, indicating a heightened possibility of breaches.
Dr. Aleksandr Yampolskiy, CEO and Co-Founder of SecurityScorecard, highlights the vulnerability of the global economy due to the reliance on a small group of vendors, comparing it to a house perched on a cliff’s edge. The report also mentions ransomware operators C10p, LockBit, and BlackCat systematically targeting third-party vulnerabilities at scale, posing significant risks to their vast customer bases.
The report suggests that companies spend significant amounts annually managing cyber risk within their vendor ecosystem, despite this, the cybersecurity of even their smallest vendor can jeopardize their billion-dollar business. To mitigate supply chain cybersecurity risks, the report recommends steps like identifying single points of failure, continuous monitoring of the attack surface, automatically detecting new vendors, and operationalizing vendor cybersecurity management.
Charlie Lewis, Partner at McKinsey, emphasizes the need for a shift in how companies think about their cyber ecosystem risk in the interconnected digital landscape to build mutual support with peers, competitors, and vendors. The research insights underline the importance of taking action against third-party risk, countering vendor-related threats, and reshaping companies’ perception of cyber ecosystem risks.
