Reducing supply chain cyber risk begins with recognizing social engineering as today’s biggest threat

Social Engineering Threats in the Supply Chain: The Overlooked Risk

Rising Threats
Recent studies, including research from Resilience 360 (DHL Consulting), reveal a 78% increase in cybersecurity attacks and incidents impacting the supply chain. Analysts, researchers, and even the FBI have issued public warnings about the risks embedded in the global supplier ecosystem.

Vendor Screening Gaps
While many large organizations—particularly Fortune 500 companies—have increased their scrutiny of new vendors by requesting details on firewall policies, compliance certifications, and data protection measures, there is a noticeable gap:

• What is your human cyber risk score?
• How do you ensure employee cyber awareness?
• What is your email security strategy?

The omission is concerning, given that nine out of 10 cyberattacks start with an email phishing campaign.

Exploiting the Weakest Link
Over 56% of organizations report breaches caused by their suppliers. Cybercriminals know it is often easier to compromise a small or medium vendor with weaker defenses than to attack a large organization directly.

The Rise of Business Email Compromise (BEC)
BEC attacks bypass traditional defenses by avoiding malicious attachments or URLs. They rely on social engineering, posing as executives or colleagues to convince recipients to transfer funds or update sensitive information.

• In 2019, the FBI estimated $1.7 billion in losses from BEC.
• Attackers increasingly use fake login phishing websites—Bolster reported 800,000+ in the first quarter of 2020 alone.

These techniques are especially challenging for email security systems that cannot visually distinguish a fake login page from a real one in real time.

Reducing the Risk
Addressing the problem requires both technological advances and a mindset shift:

1. Acknowledge that social engineering is now one of the top supply chain risks.
2. Integrate human cyber risk questions into vendor security assessments.
3. Implement human cyber risk management tools to ensure consistent security standards across all supply chain partners.
4. Maintain ongoing employee training to keep awareness levels high.

Key Takeaway
Technical safeguards are important, but without a strong focus on the human factor, the supply chain will remain exposed to attacks specifically designed to evade detection.