One in four businesses (26%) have suffered a cyber incident that originated in their supply chain over the last year.

This is despite organisations being highly aware of the risk facing them, with nearly half (48%) stating that they have continued working with suppliers despite known resilience or security concerns.

The findings come from the Data Health Check 2026 from Databarracks, an annual survey of 500 IT decision-makers, which also revealed that in many cases organisations lack viable alternatives: more than a quarter (26%) identified “dependence on suppliers” as a main barrier to improving resilience.

Almost nine in ten businesses (89%) assess supplier resilience at onboarding, and the majority (61%) assess supplier resilience on an annual, quarterly or continuous basis.

“Supply chain vulnerabilities” was also identified as one of the top three challenges facing organisations over the next five years, cited by 23% of respondents. This is behind only AI-driven cyber threats (46%) and ransomware (26%).

Organisations that knowingly work with risky suppliers were more than 4 times as likely to experience a supplier-originated cyber incident. 43% of those organisations experienced an incident, compared with 10% of those that did not knowingly work with risky suppliers.

“This year’s findings indicate that supply chain resilience remains a critical pain point for many businesses, which the majority are aware of and which continues to be exploited by attackers. When something goes wrong at a key supplier, the cascade effects can be profound for businesses throughout the chain,” Chris Butler, Resilience Director at Databarracks, said.

“Despite good intentions around assessing supplier resilience, most companies don’t fully understand the depth of complexity in their supply chains. Often they’ll know who their core suppliers are, but beyond that, visibility drops away.

“The traditional approach to assessment has long been tick-box based, with compliance questionnaires growing longer every year. This approach creates a false sense of assurance rather than real resilience.

Recommended reading

• Less Than A Quarter of Supply Chain Leaders Have An AI Strategy
• 75% of UK Firms Fear AI Supply Chain Risk
• What Are the Top Supply Chain Tech Trends for 2025?
• Tech Integration and Talent Major Roadblocks to Scaling AI Supply Chain
• Report: Cybersecurity Tops Tariffs as Q1 Priority for Supply Chains

“To truly manage your supply chain continuity, it’s vital to actually get visibility of the situation. Business leaders need to treat supplier resilience as part of their own resilience, not somebody else’s problem. It’s a bit of a cliché but for good reason: you really need to treat your critical suppliers like you would your own business.

“Where there isn’t a viable alternative and your existing suppliers don’t have in-house business continuity skills, offer to help. Include your suppliers in your business continuity exercises and give them the chance to rehearse with you. It’s important to practise the response to disruption together rather than in isolation. Doing this will benefit you in the long run.”