Why Your Biggest Cyber Risk Might Not Be Your Own
In late August 2025, a cyberattack hit Jaguar Land Rover. The company shut down its IT systems to contain it, which meant shutting down production too. UK plants stood idle for around five weeks. By the time the UK’s Cyber Monitoring Centre modelled the damage, the figure came to £1.9 billion, and the businesses affected were not just JLR. Over 5,000 UK organisations felt the impact, the vast majority of them suppliers, logistics firms and smaller businesses that depend on JLR’s production line for their own income.
None of those 5,000 businesses were the target. They were just connected to one.
Your Security Does Not End at Your Own Front Door
Most businesses think about cyber security as something that happens inside their own four walls. Their own passwords, their own laptops, their own staff. That thinking made sense when businesses operated in isolation. Very few do anymore.
A modern SME typically depends on a web of external suppliers, cloud platforms, software vendors and outsourced services, any one of which can become the route an attacker uses. If a supplier with access to your systems or your data gets breached, that breach becomes your problem too, whether or not your own defences were perfect.
The Gap Between the Risk and the Response
This is where the data gets genuinely concerning. According to the UK Government’s Cyber Security Breaches Survey 2025/2026, only 15% of UK businesses have reviewed the cyber security risks posed by their immediate suppliers. Just 6% have reviewed their wider supply chain beyond that. Among large businesses the figure is considerably higher, but for most SMEs, supplier risk is simply not being looked at.
That gap is not unique to the UK. Global research from Verizon’s annual breach investigations report found that third parties were involved in 30% of all data breaches analysed, roughly double the share from the year before. Separate research from IBM has found that breaches involving a third party typically take longer to identify and contain than breaches confined to a single organisation, giving attackers more time to do damage before anyone notices.
Why This Is Getting Worse, Not Better
Supply chains have become more interconnected, not less, as businesses increasingly rely on cloud platforms, outsourced IT, and specialist software vendors rather than building everything themselves. Every one of those relationships is convenient. Every one of them is also a door that is not entirely under your own control.
Attackers have noticed. Rather than trying to breach a well-defended target directly, it is often far easier to find one under-defended supplier with access to dozens of client networks, and use that single weak point to reach everyone connected to it.
What Sensible Supplier Oversight Actually Looks Like
None of this means auditing every stationery supplier in forensic detail. It means being deliberate about the relationships that carry risk.
Start with access, not size. The supplier that matters most is not necessarily your biggest contract. It is whichever one has a login into your systems, a copy of your client data, or a direct network connection.
Ask a few basic questions before signing anything. Do they use MFA internally? Do they have a plan if they are breached? Would they tell you promptly if they were? Most suppliers who take security seriously can answer these without hesitation. The ones who cannot are telling you something too.
Review access on a schedule, not just at onboarding. A supplier relationship that made sense two years ago, with access that was never revisited since, is exactly the kind of loose end that turns a small incident into a large one.
Keep the list short and know what is on it. Most businesses have no single, current list of which external parties can access what. Building that list is often the single most useful hour a business spends on this all year.
The Question Worth Asking
If one of your key suppliers were breached tomorrow, would you know quickly, and would it reach anything of yours?
For most SMEs, the honest answer is uncertain, not because anyone has been careless, but because supplier risk rarely gets a deliberate look until something forces the issue. The businesses that get ahead of it are simply the ones who decided to look before that happened.
Find Out Where Your Practice Stands
Answer a few quick questions in our free Business IT Health Check and find out exactly where your business stands, along with practical tips on what to tackle first. It takes less than 5 minutes, it is written in plain English, and there is no hard sell at the end.
