I work in corporate procurement. Almost all the security-related disruptions we've had in the last two years came from our suppliers, not our own systems.
One of our suppliers' systems was breached; they didn't access our data directly, but they got hold of our correspondence with them and then sent us a fake invoice.
I'll share how we've integrated this into our procurement processes and where we're struggling, open to additions.
Spot on. Supplier-related risk determines the weakest link regardless of an organization's own maturity level.
Let me suggest an actionable framework that can be integrated into procurement processes.
First, categorize suppliers by criticality. Suppliers who access our data, connect to our systems, and those who just issue invoices can't be subject to the same audit. Sending everyone the same 100-question checklist creates bureaucracy that nobody fills out correctly.
For critical suppliers, I recommend including these clauses in the contract: reporting security incidents to us within a specific timeframe, disclosing subcontractor usage, destroying our data at the end of the contract and documenting it, and ensuring access is via named accounts.
The fake invoice case you described is a separate issue: this is a process gap, not a technical one. Changes to payment details shouldn't be accepted solely via correspondence; they must be verified via a second channel using a known phone number. This single rule prevents the most common financial losses.
Finance strongly supports this last point, we experienced almost the exact same thing.
Our rule is this: when a request to change bank account details comes in, we don't reply via the channel it came from. We call the old phone number on file. We never call the number listed in the email, because that number could also be fake.
We also set a threshold amount: first payments above a certain amount require two signatures. It slowed things down, yes. But it saved us once, and that one time paid for all the delays.
As an account manager, let me look at this from the supplier side, because we get these audits too.
I must say: a well-prepared security annex benefits suppliers too, because it clarifies expectations. Where we struggle is every client sending question lists in different formats and scopes. We write the same info ten times a year on different templates.
Here's a suggestion: if you accept independent certifications, state that upfront. Use a short form for suppliers with certifications, and a long form for those without. It reduces work for both you and us.
Adding from Compliance: the subcontractor chain is often overlooked in most assessments.
You audit your supplier, they outsource part of the work to another company, and your data reaches that company. If the contract doesn't require prior notification of subcontractor usage and passing the same obligations down to them, you're essentially blind to the second link in the chain.
Three different views emerged, they all complement each other. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.
The biggest time-waster for us was not knowing who had the final say... Hope this helps.
It's rare to find an explanation this clear. Taking measures without an inventory leaves doors you haven't seen open.
Start with a small trial; don't commit to everything at once. If you post the result here, it will help others too.
Let me summarize the topic, since several different answers were given. An automated scan report is not the same as a penetration test.
Correct me if Im wrong.
Let me summarize the topic, since several different answers were given. The harder it is to reverse a decision, the slower you should make it.
Hope this helps.
Don't miss this: Having backups accessible on the same network and with the same identity makes them part of the target.
Processes without records never improve, because you don't know what to fix. Correct me if I'm wrong.
Let me clarify the technical side. People defend habits, not processes. Resistance comes from there.
Most incidents start with a leaked password, not a vulnerability. Correct me if I'm wrong.
I feel the same way. The answer varies greatly by industry; there is no one-size-fits-all rule.
If you post the result here, it will help others too.
let me summarize the topic, since several different answers were giveen then when making decisions, write down the worst-case scenario too not just the best.
if I were you I'd go this route.
Let me summarize the topic, since several different answers were given. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.
That's all sorry if I went on too long.
Doki · Interface design · 2026
Yes, that's exactly how it is with supply chain. Trying to do this alone is the most expensive way.
Of course, it varies if your situation is different.
I felt relieved reading this answer, so it's not just me. The harder it is to reverse a decision, the slower you should make it.
Hasty decisions become decisions you have to fix six months later. Good luck with that.