Hidden cyber risk in supply chains: Why vendor vetting is critical for manufacturers

David Zey Gerry Pitt

September 8, 2025

It’s 2:30 a.m.

Your factory hums under dim lights, machines working through the night while most of the country sleeps.

But beyond the steady rhythm of production, a vendor’s system is tunneling into your network, and it’s not their people at the keyboard.

In today’s manufacturing landscape, digital transformation is revolutionizing operations from automated lines to cloud-based inventory systems.

With that progress comes a growing vulnerability: third-party cybersecurity risk.

Though manufacturers often focus on protecting their own environments, many overlook the cyber hygiene of their suppliers, contractors and service providers.

That blind spot can be costly and even catastrophic.

Why third-party risk is a manufacturing concern

Manufacturers operate within complex supply chains involving dozens or even hundreds of external partners.

These third parties may have access to sensitive systems, proprietary designs, production schedules and customer data.

If one of them is compromised, the ripple effect can disrupt operations, damage reputations and expose businesses to legal and financial consequences.

These partners can be suppliers or customers, making the risk bi-directional, as they are also another company’s supplier.

This interconnectedness means a breach in one organization can cascade across multiple tiers of the supply chain, affecting upstream and downstream partners alike.

Cybercriminals are increasingly targeting manufacturers through their vendors.

According to the 2025 Imprivata Report, 42% of manufacturers experienced third-party-related breaches in the past year, with 35% of those incidents stemming from excessive vendor privileges.

This means manufacturers can’t just worry about themselves – they must also consider the risk they pose to their customers.

If a manufacturer is compromised due to a vendor breach, it may inadvertently expose its own customers to risk, creating a domino effect of liability and disruption.

The manufacturing sector is particularly vulnerable due to several factors.

Many facilities still rely on legacy systems that are difficult to secure.

Operational technology (OT) networks often lack proper segmentation, making it easier for threats to move laterally once inside.

Additionally, just-in-time production models heighten the impact of any disruption, as delays can quickly cascade through the supply chain.

Real-world examples of vendor-driven breaches

The 2013 Target breach remains a textbook case.

Hackers gained access to Target’s network through a compromised HVAC contractor, ultimately stealing data from more than 40 million credit cards.

More recently, the SolarWinds attack in 2020 demonstrated how a trusted software update could be weaponized to infiltrate thousands of organizations, including government agencies and Fortune 500 companies.

In June 2023, the MOVEit Transfer tool – widely used for secure file transfers – was compromised in a major supply chain cyberattack.

The breach affected more than 620 organizations, including manufacturers, airlines and government agencies.

Attackers exploited a vulnerability in MOVEit’s web interface, deploying a web shell called LEMURLOOT to steal data from transfer databases.

Among the victims were British Airways, Boots and Aer Lingus, with leaked data including employee IDs, national insurance numbers and contact details.

The expanding attack surface in manufacturing

The rise of Industry 4.0 technologies, such as IoT, cloud computing and artificial intelligence, has significantly broadened the attack surface in manufacturing.

Though adoption has been gradual, these innovations introduce complex vulnerabilities across both information technology and operational technology environments.

The convergence of these systems, once isolated, now creates new pathways for cyber threats to move laterally across networks.

IoT devices, for example, often lack robust security controls and can be exploited to gain access to production systems.

Cloud platforms, while scalable and efficient, can expose sensitive data if misconfigured.

Even AI, which is increasingly used for predictive maintenance and quality control, is introducing a new breed of threats such as data poisoning, model manipulation and automated phishing that target the very algorithms manufacturers rely on.

A report published by Cybersecurity News identified 29 distinct threat actor groups targeting manufacturers in early 2025, with ransomware and supply chain attacks leading the charge. 

These attacks are not just opportunistic – they’re strategic, aiming to disrupt production, steal intellectual property and exploit interdependencies between vendors and customers.

Adding to the complexity, nation-state actors are increasingly involved.

These groups target proprietary designs, trade secrets and industrial control systems for economic and strategic gain.

Because manufacturing is considered critical infrastructure, it’s a high-value target for espionage and disruption.

Attacks may be designed not only to extract data but to destabilize supply chains or gain geopolitical leverage.

In this environment, manufacturers must rethink cybersecurity beyond perimeter defenses.

Protecting the digital factory now requires zero trust architecture, continuous monitoring and vendor risk management that accounts for both upstream and downstream exposure.

Understanding the TPRM lifecycle

Third-party risk management (TPRM) is a continuous process that helps manufacturers ensure vendors don’t become security liabilities.

In tightly integrated supply chains, where downtime is costly, a structured approach is essential.

It starts with identifying all third parties, such as suppliers, service providers, software vendors and contractors and cataloging their access levels and roles.

Once identified, each vendor’s cybersecurity posture should be assessed through certifications, questionnaires and breach history, with special attention to those handling sensitive data or integrating with operational technology.

Risk mitigation follows, using contractual safeguards, technical controls like limited access and multi-factor authentication and policies that enforce cybersecurity standards.

Because threats evolve, ongoing monitoring is vital.

Manufacturers should use real-time tools to track vendor risk and reassess regularly, especially during renewals or service changes.

Finally, secure offboarding ensures that when a vendor relationship ends, access is revoked, data is handled properly and no vulnerabilities remain.

This lifecycle helps manufacturers prevent breaches, comply with regulations, protect intellectual property and maintain customer trust, all while building a resilient, secure supply chain.

How mature is your vendor risk strategy?

Before implementing or overhauling a TPRM program, it helps to assess where your organization stands today.

A Simple three-level maturity diagnostic:

• Level 1: Ad Hoc – No formal vendor inventory. Vendor access is unmanaged. No breach notification clauses in contracts. Risk is handled reactively.
• Level 2: Procedural – Vendor onboarding includes cybersecurity vetting. Contracts include security language. Risk is reviewed annually.
• Level 3: Strategic – Real-time monitoring of vendors. Zero trust and network segmentation in place. Risk dashboards inform leadership. Security posture improves through continuous collaboration with vendors.

Most manufacturers today operate somewhere between Level 1 and 2 and moving to Level 3 doesn’t require a full-time CISO.

With the right process and leadership, it’s achievable with fractional guidance and modern tools.

Best practices for managing third-party risk

Effective third-party risk management in manufacturing begins with strong contracts.

These should include clear requirements for breach notification, regular security audits and adherence to cybersecurity standards.

Such provisions ensure accountability and transparency from vendors.

Limiting access is equally important.

Manufacturers should apply the principle of least privilege, ensuring vendors only access the systems and data necessary for their role.

This can be enforced through network segmentation and robust access controls.

Continuous monitoring is essential, as static assessments like SOC 2 or ISO 27001 certifications are no longer sufficient on their own.

Real-time monitoring tools can detect shifts in vendor risk posture before they escalate into serious threats.

Cybersecurity awareness must also extend across internal teams.

Procurement, legal and IT departments should all understand the implications of vendor relationships and share responsibility for managing risk.

Adopting a zero-trust architecture further strengthens defenses.

This model assumes no user or system is inherently trustworthy, making it especially effective in manufacturing environments where remote access and third-party integrations are common.

Business alignment is critical when responding to incidents.

Manufacturers should establish clear internal protocols for actions that may affect customers and vendors, including thresholds for customer notifications, criteria for escalating or terminating vendor relationships and coordinated messaging across legal, sales and operations teams.

For organizations lacking in-house expertise, fractional IT leadership offers a strategic solution.

A fractional CIO or CISO, an executive engaged part-time, can provide high-level oversight without the cost of a full-time hire.

These professionals can develop and implement TPRM frameworks, conduct cybersecurity audits, advise on contract language, lead incident response planning and deploy monitoring tools.

Their cross-industry experience allows them to tailor best practices to the manufacturer’s size and risk profile.

According to industry research cited by The Fractional Fix and referencing a 2024 McKinsey report, companies using fractional executives achieve comparable results at 30-50% lower total cost than full-time hires.

Questions every board, executive should be asking

Third-party cybersecurity isn’t just an IT issue.

It’s a business continuity and brand risk issue. 

Board members and C-level executives should ask their teams:

• What critical vendors have system access, and how are they segmented?
• Do our contracts mandate breach notifications and regular security reviews?
• When was the last time we assessed vendor risk across the supply chain?
• Do we track how our own cybersecurity posture affects customers?
• If a vendor were compromised tonight, what’s our response plan, and who gets notified?

These are non-technical, strategic questions that shape how resilient your business will be in the face of growing third-party risk.

Final thought

Cyber threats don’t always kick down the front door – they often sneak in through the side, disguised as trusted partners.

In a world where your business depends on others to keep the wheels turning, it’s not enough to lock your own doors.

You need to make sure everyone you let in is doing the same.

Whether it’s a supplier, a software vendor or a customer with access to your systems, their security practices can directly impact yours.

So, take the time to ask questions, set expectations and build relationships that are as secure as they are productive.

Because in today’s manufacturing world, protecting your business means protecting your entire network.