Reinventing resilience: how an ecosystem mindset builds unbreakable supply chains

By Sergey Soldatov, Head of Security Operations Center at Kaspersky.

Today, a business functions as a complex ecosystem where each participant influences the overall results, reputation and, more importantly, the sustainability of the wider organization. Every business is part of a vast network of partners, suppliers and service providers whose actions can ripple across industries. As such, business resilience now depends not only on internal protection measures, but also on the strength and security of those external connections. As technology ecosystems grow more perplexing, protecting your supply chain means understanding that risk can emerge from any link, even those further hidden from view.

According to a recent study conducted by Kaspersky’s internal market research center, supply chain attacks ranked as the top threat faced by companies in 2025. Large enterprises were especially vulnerable, given their extensive networks of contractors and third-party vendors. Consequently, it is now essential for business leaders, chief information security officers (CISOs), information security managers and procurement executives, to not only grasp the risks posed by these attacks but also to deploy robust protective measures that can effectively mitigate them.

A key to managing this complex chain of interactions is an ecosystem approach – a model, in which an organization treats its own security and the security of its contractors and partners as a single, interconnected system. Instead of viewing supplier risks as secondary, this approach assumes that vulnerabilities anywhere in the chain can directly affect the organization itself. It therefore requires unified standards, shared responsibilities and coordinated controls across all stakeholders.

This ecosystem mindset covers the entire lifecycle of cooperation: before engaging in partnership, during collaboration and after the termination of the contract. In this article, we will examine a set of controls that organizations can implement at every stage of interacting with suppliers to reduce the their exposure to supply chain threats.

Frontline defense: pre-contract control

A strong ecosystem approach to supply chain security begins with embedding partner security considerations into internal frameworks and defining how it will be evaluated.

Start with building an internal system of security requirements for suppliers and contractors, which governs how suppliers are assessed, approved and managed. Establish internal policies regarding supplier onboarding, data processing, access rights and minimum baseline indicators that every third party must meet. For instance, this can be compliance with globally recognized standards like ISO 27001 or SOC2 for admission to tenders. Simple OSINT techniques can reveal whether a coordinated vulnerability disclosure program, historical CVE records and bug bounty programs are in place. The speed with which the vendor resolves issues reveals how seriously they treat product security. By starting with internal standards and rigorous verification of all suppliers, businesses can ensure that every supplier enters the ecosystem with a verified level of maturity.

More action items on how to verify the security of your partners can be found in a dedicated check-list, prepared by Kaspersky experts.

Another indispensable practice is embedding IT security requirements into suppliers’ contracts. According to the Kaspersky’s report, only 37% of businesses apply this measure to mitigate supply chain risks. By stating expectations in writing, companies gain predictable control over how third parties handle sensitive information, manage vulnerabilities and respond to incidents.

Data privacy clauses oblige suppliers to protect corporate information and customer data, preventing unauthorized disclosure or misuse. Technical standards mandate the use of encryption, two‑factor authentication, secure coding practices, and regular software updates — all of which reduce the likelihood of exploitation through outdated or vulnerable systems. Clear incident response rules specify how quickly a contractor must notify the company of a breach and outline their responsibilities in supporting investigation and containment.

Additionally, for critical environments it’s essential to request source code review. It provides the deepest visibility into how a product actually behaves and where the hidden risks may exist. By examining the code directly, especially for components that handle authentication, data processing or communication, technical specialists gain assurance the product is trustworthy at its core.

Rely, but validate — collaborating with confidence

After the first checks are done and the availability of necessary policies and a chosen supplier’s conformity with all security criteria are confirmed, it’s time to mitigate the risks that emerge once you get down to business. Suppliers may use outdated software, rely on vulnerable third-party tools in turn or have employees with compromised credentials. Their systems may be targeted by attackers specifically because they offer an indirect path to your environment.

Thus, step two is to ensure continuous advanced (XDR/EDR) infrastructure monitoring. It helps detect unauthorized access, or exploitation attempts early, reducing the window of opportunity for attackers. It also allows organizations to correlate threat intelligence data with real activity inside their environment, ensuring that emerging vulnerabilities or relevant threat campaigns are identified before they escalate. Advanced monitoring transforms supply chain security from one-off checks into a dynamic defense layer that protects the ecosystem throughout the entire lifecycle of cooperation.

To ensure that long-term partners maintain a consistently strong security posture, organizations should also perform at least one comprehensive audit per year. These reviews should include compliance checks, technical assessments such as penetration testing and simulated attack scenarios originating from the supplier’s network.

Additionally, before deploying any updates from the vendor into production, it’s recommended to run them in a controlled isolated sandbox to check for abnormal behavior and compatibility with the software environment. This pre-deployment testing prevents compromised or poorly implemented updates from reaching critical systems.

Last but not least, organizations must adopt a systematic approach to cyber education, carrying out regular assessments of the team’s cyber literacy level and implementing training to fill gaps in employees’ knowledge. It's crucial to allocate resources not just to training your own staff but also to enhancing the security proficiency of your partners. Offering vendors joint workshops builds a common language around the risks and helps minimize the probability of attacks that exploit the human factor on both sides. Another effective way is gamified security competitions such as CTF challenges to practice attack-defense techniques in a safe environment.

Offboarding without blind spots

Finally, ending cooperation with a supplier is a high-risk moment in the supply chain lifecycle. This is why organizations need structured offboarding processes that eliminate access and protects sensitive data.

First, companies must revoke all digital access and dismantle system integrations to prevent former contractors from remaining connected to internal infrastructure. This includes disabling accounts, API keys, SSO links, VPN profiles, and removing cloud resources they deployed.

Secondly, organizations must secure and retrieve all data, verifying that the supplier has deleted corporate information, returned intellectual property, and restricted any future access to confidential or personal data. Formal destruction certificates and strict data minimization practices help prevent unauthorized retention or misuse after the relationship ends. Together, these measures close every remaining entry point, ensuring a clean and secure disengagement that protects the ecosystem from lingering vulnerabilities. 

In today’s world, where supply chain weaknesses surface in global news, proactive preparation has become a fundamental requirement rather than an optional enhancement. Organizations that thoroughly interact with suppliers at every stage of cooperation, formalize contractual expectations on their side and invest into the security of their partners, not only embed resilience into their operations, but also gain a competitive advantage.