Predict where an organisation's risk sits outside its own walls.
A well-defended company is compromised through a small supplier's software update. Whose security failed?
Yes.Trusting a supplier's code means inheriting their security. That is not a mistake in itself; it becomes one when the inherited risk is never assessed.
Not quite.The supplier was compromised. The company chose to run their code with high privileges and did not verify what it did.
Not quite.This route has been used repeatedly and publicly for years. It is now a standard part of any risk assessment.
Anything you install, import or connect to becomes part of your security. The boundary is not the office wall — it is every piece of code you trust.
Slide out from an organisation and count what it depends on.
Its own systemsPlus direct suppliersPlus their suppliers
Things that must stay secure40
Things it directly controls40
Its own systemsA few dozen applications, all under its own control.
Things that must stay secure260
Things it directly controls40
Plus direct suppliersSoftware vendors, cloud services, contractors with access.
Things that must stay secure2,400
Things it directly controls40
Plus their suppliersOpen-source libraries, sub-processors, update channels. Thousands of dependencies, most of them invisible.
What does that gap mean in practice?
Yes.It is why supplier assessment, dependency inventories and update verification exist. You cannot secure what you cannot see, and the first job is finding out what you actually depend on.
Not quite.Nobody can, and homemade versions of well-maintained components are usually less secure.
Not quite.Most are maintained well. The problem is that the risk is unexamined, not that it is inevitably high.
Move the control to see what changes.
Which of these are part of an organisation's attack surface?
A software library used in one internal tool.
A contractor's laptop with access to the network.
An automatic update channel from a vendor.
A competitor's systems.
A retired application still running with no owner.
Yes.Anything that can reach in, or that runs code inside, counts. The retired application with no owner is a classic — nobody patches it because nobody knows it is theirs.
Put a supply chain compromise in order.
Tap them in order — first to last.
Supplier compromised→Signed update published→Everyone installs it→Inside thousands at once
The defence — install updates promptly — is the delivery mechanism.Yes.Every customer did the right thing. Installing signed updates promptly is exactly what good practice requires — which is what makes this route so effective and so hard to defend against.
If installing updates can be the route in, what should organisations do?
Yes.Unpatched systems are a far more common route than compromised updates. The answer is containment — least privilege, monitoring, separation — rather than the much worse alternative of not patching.
Not quite.Delay leaves known vulnerabilities open, which is the route used far more often.
Not quite.Genuinely reduces the surface, and it has real costs and cannot be taken far. It is a useful part of an answer rather than the answer.
Lesson complete
Everything you install or connect to becomes part of your security.