How do we find supply chain risk we cannot see?
CyberRank Research
Hidden supply chain risk sits where contracts do not look: in software and updates your vendors ship, in the suppliers behind your vendors, in AI models your vendors take from other providers, and in the cryptography that carries your data through them. Find it by mapping fourth parties and monitoring continuously. CyberRank shows fourth parties with ratings and reassesses monitored vendors nightly.
TL;DR
- Software updates and open-source packages carry attacks into customers that trust the supplier.
- Your vendors' own suppliers, the fourth parties, pass their risk on to you.
- A vendor's AI model often comes from another provider, which makes that provider a fourth party too.
- CyberRank shows fourth parties with ratings, AI use and quantum-crypto posture (Beta) in one vendor profile.
The answer, piece by piece
| Part of the question | Short answer | Read more | How CyberRank helps |
|---|---|---|---|
| Software and updates | Short answerAttacks travel through signed updates and packages | Read morehow supply chain attacks work | How CyberRank helpsVulnerability signals on vendors' internet-facing systems |
| Vendors' suppliers | Short answerMap fourth parties and the providers your vendors share | Read morefourth parties in third-party risk management | How CyberRank helpsFourth parties with their own ratings, combined across two levels |
| AI models | Short answerA vendor's general-purpose AI provider is a fourth party | Read moreAI as a supply chain risk | How CyberRank helpsShows vendors whose public material names a GPAI model or AI features (Beta) |
| Cryptography | Short answerVendors choose the key exchange your data travels over | Read morequantum readiness as a third-party risk | How CyberRank helpsQuantum-crypto posture per vendor (Beta) |
Software and updates
ENISA's analysis of 24 supply chain attacks found that in about 66% of incidents attackers targeted the supplier's code, and about 62% exploited customers' trust in their supplier. Signed updates pass endpoint checks and dependencies arrive through package managers, so the compromise looks like a normal release. The attack types are explained in detail in our article on supply chain attack examples and prevention.
Your vendors' own suppliers
Fourth parties are the suppliers behind your vendors: their cloud hosts, payment processors and software providers. When several of your vendors rely on the same provider, one incident there reaches all of them at once. Fourth-party visibility is one of the capabilities explained in detail in our guide to third-party risk management.
AI models behind your vendors
A CRM's assistant or an HR platform's ranking feature often runs on a general-purpose AI model from another provider, which makes that provider a fourth party. AI also adds its own routes in, such as prompt injection, data leakage into model training and model supply chain compromise. These risks are explained in detail in our article about the EU AI Act and your vendors.
The cryptography your data travels through
Payroll data, customer files and API traffic pass through vendors' TLS and SSH connections, each with a key exchange the vendor chose. If that key exchange is classical-only, recorded traffic can be decrypted once a quantum computer exists. How to check this across vendors is explained in detail in our guide to quantum security and post-quantum cryptography.
Where CyberRank does not help
CyberRank cannot review a vendor's source code or see inside its build systems, so it cannot catch a malicious update before it is disclosed. It sees AI and cryptography only where they leave a public trace, and shows the fourth parties it can identify from public evidence. It does not replace the subcontracting clauses in your contracts.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating