Cybersecurity: Managing Third-Party Supply Chain Risks

For any CEO today, one of the key priorities is defining how to navigate commercial challenges and gain agility while keeping the organization safe. Businesses are increasingly connecting their operations to a dense network of suppliers, logistics partners, and software developers to remain competitive. However, in this race for efficiency, we are overlooking an uncomfortable reality: We no longer have full control over who has access to our digital ecosystem and critical assets.

In this hyperconnected environment, it is important to highlight that, according to Kaspersky, 43% of companies in Mexico reported cybersecurity incidents in the past year that did not originate within their own systems, but rather in those of a third party. This is not a minor figure, it is well above the global average (31%) and reveals a fundamental issue in how we are managing our businesses: our network of suppliers has effectively become one of the largest attack surfaces.

The Mistake of Only Looking Inward

In boardroom discussions, cybersecurity budgets are often approved with the goal of “shielding” the organization through advanced protection tools or increased internal training. However, while we focus on locking the front door with double security, we are leaving the windows open. Cybercriminals are no longer wasting time attempting to break through large-scale infrastructures when they can gain access using the credentials of a payroll provider, an accounting firm, or a logistics partner.

Why attack a multinational directly when it is easier to compromise the partner managing its inventory and deliveries? These are essential allies that operate within company systems every day, making trust their most valuable asset, but also their greatest vulnerability. Kaspersky’s data supports this reality, showing that 31% of organizations in Mexico have experienced attacks that specifically exploit these strategic relationships.

This is where the issue stops being purely a cybersecurity matter and becomes a direct threat to profitability. An attack on a key supplier can halt a production line or freeze a supply chain within minutes. And when that happens, the end customer does not care who is at fault; the reputational and financial impact ultimately falls on our brand. In essence, we absorb the recovery costs and the loss of market value.

How to Protect Yourself 

According to recent data from the World Economic Forum, a large organization must manage, on average, more than 130 suppliers with access to its systems. Maintaining visibility over what happens across those 130 nodes is, from a human standpoint, virtually impossible. So how can this be managed without hindering operations? The answer is not to stop working with third parties, but to change the rules of the game. Today, resilience comes down to three very specific priorities that must be addressed at the executive level.

First, supplier selection cannot be based solely on cost. Their security protocols must be subject to the same level of scrutiny as their commercial proposal. If a potential partner cannot clearly demonstrate how they protect their data — and yours — any cost savings they offer are ultimately illusory; in the long run, the cost of a security incident will far outweigh the initial benefit.

Second, contracts must enforce transparency. Many agreements remain ambiguous when it comes to how security breaches should be handled. It is essential to establish clauses that require immediate incident notification and grant the right to audit systems when necessary, enabling verification of cybersecurity practices. Without clear legal consequences, security is unlikely to become a true priority for the provider.

Finally, having full, real-time visibility is critical. Given the impossibility of manually monitoring dozens or even hundreds of access points, organizations require advanced detection tools capable of identifying unusual behavior in third-party connections before the damage becomes irreversible. In many cases, early detection is the difference between a contained incident and a financial catastrophe.

A Necessary Reflection

As we highlight at Kaspersky, every third-party connection today represents a potential gateway to strategic information. It is time to stop viewing suppliers as isolated entities, as the future of business will not be defined by who has the most expensive technology, but by who manages their partnerships most effectively.

The question for executives is not whether they trust their suppliers, but whether they can afford to assume that everything is under control every single day. In an environment as interconnected as ours, a third party’s mistake becomes your own, and the market, much like cybercriminals, rarely forgives that lack of foresight.

For this reason, the call to senior leadership in Mexico is to make supply chain cybersecurity a core business priority. Organizations should not wait for an operational disruption to force a reactive response in the midst of a crisis; instead, they must begin today by promoting security across their most critical partners, establishing shared protection standards and demanding greater visibility into their risk posture.

True cyber resilience is not a solitary effort; it is built through strategic collaboration, strong governance, and continuous oversight with no blind spots. Within the supply chain, mutual protection is essential to ensuring operational continuity and long-term business performance.