The expansive, intertwined business landscape in the UK has cyber risks lurking across the supply chain, with potential far-reaching effects.

This is according to Bitsight, a cyber risk intelligence firm, which released its Under the Surface: Uncovering Cyber Risk in the Global Supply Chain report which examined global and UK data, based on an analysis of 500,000 organisations over 61 million digital supply chain relationships.

The findings highlight how deeply interconnected businesses are, and how cyber risks in just one part of the supply chain can have disastrous, pernicious effects.

The study found that UK supply chains are typically larger and more complex than the global average.

The typical UK organisations uses 29.1 different providers and 81.6 different products, a 10% larger supply chain than the global average.

This brings an increase of risks, as the larger and more complex a supply chain, the greater the attack surface, increasing opportunities for cyber-criminals to infiltrate networks.

Supply chain risks don’t just come from direct providers – they extend through multiple tiers, creating hidden vulnerabilities that businesses may not be aware of.

Reliance on China

The research found an interesting trends – that three in ten (30%) of UK supply chain relies on organisations designated by the US Department of Defense as “Chinese Military Companies”.

The continued reliance on these providers underscores the challenge of securing the digital supply chain against foreign influence.

Even with increased scrutiny and regulatory efforts, Chinese state-linked firms maintain a significant foothold in UK industries, making it critical for organisations to assess their vendor relationships and mitigate potential risks.

The Hidden Pillars

he UK’s most influential global providers aren’t just big-name technology firms – they include niche software vendors that quietly power essential industries.

Bitsight research identifies “Hidden Pillars”, the lesser-known technology companies that serve large portions – or even the majority – of specific industries. A security failure at one of these companies could trigger cascading effects within and across industries.

Customer count does not equal criticality, the research found, as some niche providers serve only a handful of companies yet support massive market share in industries like energy, finance, and logistics.

In fact, some of the most critical software and infrastructure providers operate with fewer than 50 employees, yet their technology is embedded in Fortune 500 companies and global enterprises.

Recommended reading

• Supply Chain Organisations Struggle to Future Proof
• DORA Compliance | UK Supply Chain Doubts Persist
• Cyber-attacks on the Tech Supply Chain Spiked in 2024

Provider Challenges

Organisations that supply digital products and services – known as providers – often face far greater cybersecurity challenges than the businesses they serve.

With larger attack surfaces, more complex vendor relationships, and increasing risk exposure, providers must take stronger measures to secure their own ecosystems.

On average, the research found that providers use 2.5 times more products and have ten times more internet-facing assets globally, making them more exposed to cyber threats.

While providers outperform consumers in four of six security standards – including DMARC, SPF, DKIM, and DNSSEC – they lag behind in areas such as patch management, open ports, insecure systems, and botnet infections.

The UK is no different, businesses exhibit better cybersecurity performance than their providers. Moreover regardless of provider size (as measured by market share) there are going to be some providers that fail to achieve or maintain a good security posture.