Large supply chain and third-party compromises have nearly quadrupled since 2020.

66% of incidents involve the supply chain or a third party, up from 45% in 2024.

In MCP registries, for every server provided by a verified technology vendor there are up to 15 lookalike servers from untrusted sources.

CISO confusion about cyber insurance policy coverage for supply-chain attacks decreased from 58% in 2024 to 43% in 2025.

Fewer than half of organizations monitor cybersecurity across even 50% of their nth-party supply chains.

79% of organizations state that less than half of their nth-party supply chain is currently covered by cybersecurity programs.

88% of cybersecurity leaders are concerned about supply chain cyber risks.

Only 26% of organizations incorporate incident response into their supply chain cybersecurity programs.

Nearly 40% of respondents identified data overload and the inability to prioritize issues and threats as their biggest supply chain cybersecurity challenge

50% of industrial organizations claim that supply chain threats and cybercriminal activity are their top security concern.

More than 70% of organizations reported experiencing at least one material third-party cybersecurity incident in the past year.

5% of organizations suffered ten or more third-party cybersecurity incidents.

Open-source risks and cloud misconfigurations followed supply chain vulnerabilities closely at 73%.

84% said that supply chain vulnerabilities were the most significant threat to their enterprise applications.

Supply chain-driven cyber claims were up 43%.

23% of respondents named cybersecurity their top supply chain issue.

98% of respondents integrated AI into their supply chains in Q1

Between September 15, 2024 and February 14, 2025, there was a 11.1% incease in phishing emails sent from compromised email addresses within the supply chain.

Among financial services professionals who were less than "very confident" in their program's ability to assess their supply chains for threats, more than half (56%) of global respondents identified cybercrime as the biggest challenge to their programs in 2025.

35% of financial services professionals identified political instability as a challenge to supply chain assessment.