You are someone else’s supply chain. Their attackers know it.

When a business thinks about supply chain risk, it nearly always looks one way: at its own suppliers. Is the payroll company safe? What about the IT provider, the software we rent? Those are good questions. But there’s a second view that gets far less attention, and I think it matters more for most of the businesses I talk to. You are a supplier too. In a supply chain attack, the business that gets used as the way in is very often the smaller one, and it could be yours.

The way in is usually someone smaller

The most famous example is still one of the clearest. In 2013 criminals stole the card details of around 40 million customers of the American retailer Target. They didn’t start with Target. They started with a heating and air conditioning contractor that had a login to one of Target’s supplier systems. A small firm, a stolen password, and a route into one of the largest retailers in the United States.

The pattern has repeated ever since. In 2021 attackers went through software used by IT support companies and reached up to 1,500 of their customers at once. In 2024 an attack on Synnovis, a pathology supplier, forced London hospitals to postpone thousands of operations and appointments. Last year’s attack on M&S reportedly began at an outside service desk.

From an attacker’s point of view it’s simple economics. A large organisation has a security team, a budget and people watching. Its suppliers often have none of those, and they have something just as valuable: trust. An email from a known supplier gets opened. A login from a known supplier gets accepted. An invoice from a known supplier gets paid.

“We’re too small to be a target”

This is the belief I’d most like to retire. It assumes an attacker wants what you have. Often they want what you can reach.

Think about what your business holds on behalf of others. An accountant has clients’ financial records and a login to their tax accounts. A recruitment firm has passport scans. A marketing agency has access to a client’s website and social media. A subcontractor has drawings, site access and a place on the approved supplier list. An IT company has the keys to everything.

And nearly every business has an email account that its customers trust. That alone is worth breaking into. A criminal who gets into your mailbox can read real conversations, wait for a real invoice to be due, and reply in the same thread with new bank details. Your customer sees a message from you, in your style, about a payment they were expecting. Nothing about it looks wrong, because almost all of it is genuine.

When that happens, your customer is the one who loses the money. You’re the one who has to ring them.

An attacker may have no interest in your business at all. They’re interested in who trusts you.

Ashley Adkins, fromIT

Your customers have worked this out

If you’ve noticed more security questionnaires arriving, this is why. Larger organisations have understood that their weakest point may be a supplier, and they’re pushing the question down the chain. Government contracts involving personal data have asked for Cyber Essentials for more than a decade. Defence, finance, healthcare and local authorities ask in their own ways. The Cyber Security and Resilience Bill now going through Parliament puts supply chain risk firmly on the agenda for the organisations it covers, and those organisations will pass the questions on to the businesses they buy from.

It can feel like bureaucracy, and some of the forms are badly written. But the instinct behind them is right, and it’s a commercial fact as much as a security one. Being able to show you take this seriously is becoming a condition of doing business with bigger customers. Businesses that can answer confidently win work. Those that can’t get asked awkward follow-ups, or quietly dropped from the list.

The same thing applies after an incident. This autumn’s retail breaches have been followed by warnings to customers to watch out for scam messages. Now imagine being the supplier at the start of a story like that. Even if the legal liability is arguable, the relationship rarely recovers.

What being a good link looks like

You can’t control your customers’ security. You can make sure you’re not the easy route into it. None of this is exotic.

1. Write down what you can reach. List your customers and, against each, what you hold or can access: their data, logins to their systems, the ability to send them invoices. That list shows you what an attacker would want from you.
2. Protect your email as if it were your customers’ front door. Multi-factor authentication on every mailbox, no exceptions for directors. Set up SPF, DKIM and DMARC so nobody can send email pretending to be you. The free email security checker shows where you stand in a few seconds.
3. Keep customer access to a minimum. Separate logins for each person, removed the day they leave. No shared passwords in a spreadsheet. If you no longer work with a customer, hand the access back.
4. Agree how bank details change. Tell your customers, in writing, that you’ll never change payment details by email alone, and that they should ring a number they already hold. It costs nothing and it protects both of you.
5. Decide now how you’d tell customers bad news. If your mailbox were taken over tomorrow, who would you warn, how, and how quickly? An hour’s notice can stop a fraudulent payment.
6. Get the basics certified. Cyber Essentials exists for exactly this: a recognised way to show customers that the five basic controls are in place.
7. Have honest answers ready. Keep a short document describing how you handle security, so the next questionnaire takes an hour. My guide to answering a customer security questionnaire walks through it.

Then look the other way as well

Once you’ve looked at yourself as a supplier, the questions to ask your own suppliers become obvious, because they’re the same ones. What of ours can you reach? How is it protected? How would we hear if something went wrong? You don’t need a hundred-question form. Three plain questions to the handful of suppliers who hold your data or your logins will tell you most of what you need.

A different way to see your own security

I find this the most persuasive argument for security with owners who feel they have little to steal. It moves the conversation away from “what could we lose?” and towards “who is relying on us?”

Most people who run a business care a great deal about not letting customers down. They’ll work a weekend to hit a deadline. They’ll drive across the country to put something right. Looking after the access and information customers have trusted you with belongs in the same category. It’s part of doing the job properly.

So this week, make that first list: your customers, and what you could reach of theirs. Then ask yourself how it would feel to explain to each of them that the attacker came through you. I’d use that feeling as the business case.