The Risk You Cannot See

Organisations may know their own controls intimately yet remain surprisingly blind to the businesses behind their suppliers. That blind spot is becoming dangerous. Across the EU, the Digital Operational Resilience Act (DORA), Network and Information Systems Directive 2 (NIS2) and the Cyber Resilience Act reflect a regulatory shift towards interconnected digital and supply-chain risk, while UK regulators are strengthening operational-resilience and third-party reporting expectations. The challenge is therefore moving beyond traditional vendor management towards ecosystem risk management. A supplier may look resilient while depending on several fragile subcontractors. The critical question is no longer simply “Is our supplier safe?” but “How far beyond our organisation does our real dependency extend?”

The Expanding Third-Party Attack Surface

Cyber risk increasingly enters through the side door. Cloud platforms, Software as a Service (SaaS) applications, managed service providers, open-source components and automated software updates have created an attack surface extending far beyond the corporate network. The European Union Agency for Cybersecurity’s (ENISA’s) 2025 Threat Landscape warns that criminals are increasingly abusing cyber dependencies, including service providers and open-source repositories, to amplify attacks across interconnected organisations. The UK’s 2025 Jaguar Land Rover cyber incident demonstrated the potential ripple effect, disrupting production and placing pressure on its wider supply chain.

Regulation is responding. DORA requires EU financial entities to treat ICT third-party risk as part of their ICT risk framework, while NIS2 explicitly requires supply-chain security measures. Yet another dependency is emerging quickly. AI systems may rely on external foundation models, datasets, application programming interfaces (APIs), plug-ins and cloud infrastructure that users neither built nor fully understand.

The practical challenge is therefore not simply whether a supplier is secure. Organisations need to map how technology dependencies connect and identify single points of failure. One question deserves a board-level answer. Which external technology failure could disable several critical functions at once?

Fourth- and Fifth-Party Risk Is Becoming the Hidden Threat

A pristine supplier register can still hide a messy web of dependencies. Your payments provider may rely on a cloud platform, which depends on specialist software, data services and subcontractors in several jurisdictions. This is Nth-party risk, where fourth- and fifth-party relationships can matter as much as the company you actually contracted.

The bigger danger is concentration. Ten apparently independent suppliers may ultimately run on the same cloud provider, software component or telecommunications network. One failure can therefore travel across supposedly diversified relationships. DORA recognises this explicitly, requiring EU financial entities to assess ICT concentration risk and the substitutability of providers. Its subcontracting rules also require firms to understand and monitor ICT subcontracting chains supporting critical functions.

The UK is moving in the same direction. In July 2026, regulators began direct oversight of four designated critical third parties, including major cloud providers, because disruption could affect many firms simultaneously.

Supplier mapping must therefore evolve into dependency mapping, using network analysis, dependency graphs and external intelligence. The smarter question is no longer “Who supplies us?” It is “What common dependency sits underneath them?”

The Accountability Gap

Outsourcing a service does not outsource responsibility. DORA makes this explicit for EU financial entities, which remain fully responsible for regulatory obligations when using ICT providers. UK regulators take a similarly firm position. The Financial Conduct Authority (FCA- UK) states that firms cannot delegate regulatory responsibility to third parties, while the Bank of England stresses that boards and senior management remain accountable.

This changes what good supplier governance looks like. Contractual protections, audit rights and service-level agreements matter, but boards should also understand critical dependencies, substitution options and what happens when a provider suddenly becomes unavailable. The UK’s new Critical Third Parties regime reinforces the point. Even where regulators directly oversee major technology providers, firms retain responsibility for their own operational resilience.

The overlooked issue is often exit readiness. A polished 40-page exit plan offers little comfort if data cannot be migrated quickly or the only realistic replacement requires eighteen months of integration. Organisations should therefore test exits, identify alternative providers and establish decision ownership before disruption occurs.

The governance question is simple. If a critical supplier failed tomorrow morning, who would actually own the response?

Geopolitics, Climate and the Fragility of Global Supply Chains

Procurement teams once celebrated lean inventories and the lowest unit price. Today, that bargain can unravel before the shipment leaves port. Conflict, sanctions, export controls, tariffs and extreme weather can transform an efficient supply chain into a bottleneck. UN Trade and Development reported that disruption around the Red Sea, Suez and Panama Canal pushed shipping costs sharply higher, with climate-induced low water levels also constraining Panama Canal traffic.

The response is a shift from just-in-time towards just-in-case, but resilience means more than filling warehouses. Multi-sourcing, nearshoring, friend-shoring, strategic inventories and geographical diversification reduce exposure. Crucially, five suppliers do not provide genuine diversification if all depend on the same port, semiconductor cluster or drought-prone region.

Europe is treating this as an economic-security issue. The EU Critical Raw Materials Act sets a 2030 benchmark that no more than 65 per cent of annual needs for each strategic raw material at a relevant processing stage should come from one third country.

Procurement metrics therefore need recalibration. Price should sit alongside substitution difficulty, geographical concentration, disruption probability and recovery time. The cheapest supplier can become remarkably costly overnight.

Why Annual Due Diligence No Longer Works

A supplier questionnaire is a snapshot, not a security camera. A vendor rated low-risk in January may face a cyberattack, financial deterioration, sanctions exposure or ownership change by June. That makes annual due diligence inadequate for supplier networks.

The direction of travel is continuous risk intelligence. Organisations can combine cyber ratings, financial indicators, sanctions and adverse-media screening, ownership data and operational signals to identify deterioration earlier. DORA reflects this thinking, requiring EU financial entities to monitor ICT third-party performance on an ongoing basis. In the UK, the FCA reported that more than 40 per cent of cyber incidents reported in 2025 involved a third party.

AI can strengthen this early-warning capability by spotting unusual patterns across thousands of suppliers that human teams could miss. However, automated scores can also create false positives, obscure how conclusions were reached and encourage dangerous overconfidence.

Dynamic risk tiering offers a better model. Instead of leaving suppliers permanently labelled high, medium or low risk, organisations can increase or reduce scrutiny as evidence changes. Third-party risk management then becomes less like an annual MOT and more like a dashboard warning light.

Resilience Begins Where Organisational Control Ends

The most important shift in supply-chain risk is not simply that threats have multiplied. Organisational boundaries themselves matter less. Cybersecurity, operational resilience, regulatory accountability, geopolitical exposure and supplier monitoring increasingly intersect. DORA reinforces this reality by requiring financial entities to manage ICT third-party risk as part of their overall risk framework. Organisations therefore need a living picture of their dependency ecosystem, not merely a well-maintained vendor database. Tomorrow’s resilient organisation may not have the strongest internal controls. However, it may be the one that understands what lies beyond them and has rehearsed what happens when it fails.

And what about you…?

  • How confident are you that your organisation could continue delivering critical services if a major third party suddenly failed because of a cyberattack, geopolitical disruption or financial collapse?
  • Where do you think your organisation is currently most vulnerable to third-party risk, and what practical change would make the greatest difference to its resilience?