Supply chain cyberattacks remain a major threat, although the number of affected software packages has decreased significantly in 2024. Here’s a breakdown of the three key trends:
- Customer Impact Increases: Over 183,000 customers were affected in 2024, a 33% jump compared to last year. This highlights the growing impact despite fewer vulnerabilities.
- Software Package Vulnerability Drops: Data shows a significant decrease – 40 times less than 2023 – in the number of software packages compromised in supply chain attacks.
- Shifting Tactics: While software vulnerabilities have decreased, attackers are focusing on social engineering to target suppliers’ open-source and proprietary code.
Although the threat seems less widespread compared to 2019’s peak of over 263 million impacted customers, the overall picture concerns over 700 million customers that have been affected by supply chain attacks since 2011.
Also, modern supply chains are complex, making them vulnerable to disruption through a single compromised software package trusted by multiple companies.
The takeaway is that the decrease in software vulnerabilities is encouraging, but the rising number of affected customers underscores the need for vigilance.
Companies must prioritize supply chain security by implementing strict security protocols for vendors with access to sensitive systems and data, regularly scan software updates and codebases for potential security weaknesses and train employees on social engineering tactics to prevent them from falling victim to phishing attempts.
By taking these steps, companies can build a more secure and resilient supply chain, minimizing the impact of future cyberattacks.