The Rising Tide of Cyber Risk in Global Supply Chains

Supply chains have traditionally been the foundation of international business, serving as lifelines essential to the movement of products, services, information, and value. But just as those network systems have been disrupted by the recent tariffs, material shortages and trade wars, they are increasingly threatened by a less visible, but highly impactful emerging force: ‘Cyber risk’. Gartner predicts that by 2027, 17% of total cyberattacks/data leaks will involve generative AI, causing significant financial loss. Recent high-profile cyberattacks on airlines, automobile manufacturers, hospitals, and infrastructure demonstrate that cyber threats are not abstract possibilities, but evident threats capable of paralysing global supply chains.

In Europe, airports from Heathrow to Brussels, Berlin, Dublin, and Cork were largely impacted when Collins Aerospace’s MUSE system, the shared platform upon which check-in, boarding, and baggage operations depend, suffered a ransomware attack (BBC News, 2025). Manual processes replaced automated systems, causing significant delays. In the UK, Jaguar Land Rover halted production after a cyberattack spread through its supply chain, demonstrating how disruptions at one node can cascade across the manufacturing ecosystem (Reuters, 2025). In Poland, ongoing cyberattacks on water works and hospitals highlighted the vulnerability of critical infrastructure and wider society risks from cyber insecurity (FT.com, 2025). Even if operations are not directly impacted, as with the Kering Group’s ‘data breach’ for brands such as Gucci and Balenciaga, customer data exposure (BBC News, 2025) indicates how reputational loss is just as expensive as operational shutdowns.

Ongoing research conducted by Cranfield University’s Centre for Logistics, Procurement and Supply Chain Management has shown that cyber risks propagate through supply chains from the firm level to their supply networks and on to the wider ecosystem (such as society).

One major weakness of today’s supply chains is limited visibility beyond first-tier suppliers. Cybersecurity capability is also inconsistent across the networks, where some partners invest heavily in IT security teams, monitoring, and compliance, while many smaller suppliers lack the maturity and resources to mitigate such disruptions. Interdependencies on software platforms or cloud providers also provide targeted points of failure that are expected to multiply attacks across global supply chains (witnessed from recent airline sector incidence). At the contractual level, many supply agreements do not impose strong cybersecurity requirements, leaving firms without enforceable standards or audit rights.

The good news is that cyber risks can be mitigated with appropriate strategies, and these can be categorised into three phases: pre-attack, in-attack, and post-attack cyber resilience. Firstly, organisations should proactively map out dependencies in their supply chain before any cyberattack so that they are able to identify which suppliers and systems are the most critical. Vendor auditing and including explicit cybersecurity obligations in contracts provide legal and procedural levers to enforce minimum standards. International frameworks such as ISO 27001 or the NIST Cybersecurity Framework can provide benchmarks for supplier compliance. Additionally, the National Cyber Security Centre, UK, provides tailored guidelines for SME and Large organisations on potential attacks to mitigate such advances. Recently, more companies are opting towards ‘Zero Trust Policy’, which operates under the assumption that no business partner or system should be trusted. Through network segmentation, least-privileged third-party access, and continuous verification of connections, organisations can limit the extent of cyberattacks as well as data breaches. Equally important are investments in IT upgrades, monitoring, intelligence sharing across sectors, along with human-centric, firm-level controls such as organisational awareness and employee training, which are usually neglected but are equally important for effective cyber risk management.

During a Cyberattack

When an attack is underway, resilience depends on preparedness. Organisations need an incident response ledger that anticipates supply chain scenarios and clearly defines roles, escalation paths, and communication protocols for cyber risk management. Network segmentation and isolation are necessary to prevent vendor-facing systems from exposing critical infrastructure, such as those used by airports during the MUSE attack. Rapid containment and forensic investigation help to identify the source and scope of compromise, limiting the potential for wider disruption across the supply chain ecosystem.

Post-attack

After an incident, recovery and learning are as important as technical fixes. Building redundancy through alternative suppliers, duplicate systems, and manual backstops reduces reliance on the single points of failure within supply chains. Despite limited options, reputation management through timely and transparent communication with customers and stakeholders is vital to rebuilding trust.

Within this growing landscape in the era of (Gen) AI, Zero Trust policy is a highly effective approach to cyber resilience. Identity-based access, network micro-segmentation, and continuous verification are its key principles that directly respond to many of the vulnerabilities exposed in the recent cyberattacks and data breaches. If such controls were more widespread, the scale of disruption to European airports or JLR’s supply chain might have been significantly reduced.

Globalisation and digitisation of supply chains will continue to be exposed and exploited by cyber attackers, weakening the supply chain networks. Evidently, managing cyber risks in supply chains has shifted from a side issue to a top strategic priority for Global Supply Chain Directors/Leaders. By embracing research findings to applied strategy, along with support and participation of Governments, organisations can build robust cyber resilience.