The breaches this week didn't break in the front door - they came through a supplier

The strong companies fell at the same kind of spot

Look at who got breached this week. Coca-Cola. Accenture. A semiconductor giant. Cybersecurity firms whose entire trade is defence. These are not careless outfits with no locks on the doors. Yet they all got hit - through a subsidiary, a shared vendor, a poisoned software package, an unpatched box at the edge of the network.

The strange thing is that being strong almost everywhere did not save them. That is worth sitting with, because it runs against how we usually think about safety. We tend to imagine security as a total: add up all the good defences, and a company with a hundred of them is safer than one with ten. That is the wrong arithmetic.

Security adds up like a chain

A pile of sandbags gets stronger with every bag you add. A chain does not. A chain is only as strong as its weakest link - pull on it, and it fails at exactly one point, the worst one, no matter how heavy every other link is.

A defended system is a chain, not a pile. To do harm, an attacker does not need to beat all your defences. They need to beat one - the easiest one. So the strength of the whole system is not the sum of its parts, and not even the average. It is the minimum. Your safety is set by your single worst point, and everything above that point is, for this purpose, wasted.

This is why the companies this week are such a clean illustration. Coca-Cola’s own systems may be excellent; the way in was Fairlife, a smaller subsidiary running separately. The cybersecurity firms defend themselves superbly; the way in was Klue, one supplier they all shared. Careful developers wrote careful code; the way in was one free package pulled in from a public library. Each victim was strong on average and had one link that wasn’t.

The attacker holds the pen

Here is the part that makes the minimum, and not the average, the number that counts: the attacker chooses where to push.

If damage were random - a storm hitting your fortress at some spot you can’t predict - then average strength would matter, because most of your wall is strong and the storm probably lands there. But an attacker is not weather. They survey the whole surface first, find the lowest point, and aim there on purpose. They are not trying to break your best defence. They are looking for your worst one, and they have all the time in the world to look.

So you and the attacker are optimising opposite things. You are tempted to spend where it is satisfying - hardening the systems you already understand, buying the tool with the best demo. The attacker spends nowhere; they just wait for you to leave one thing thin. The forgotten VPN box running software too old to patch. The vendor you onboarded three years ago and never reviewed again. The account with the reused password. Every one of those is a short link in a chain you were measuring by its long ones.

Why “more security” can miss entirely

This reframes what it means to get safer. Adding a tenth strong control to a system whose weakest point is an unpatched edge device does nothing - you have made a long link longer while the short link still snaps first. It can even make things worse, if the new tool absorbs the attention and budget that the weak point needed.

Real improvement means the humbler, less glamorous work: finding the minimum and raising that. This is exactly what the week’s defensive advice was pointing at, even when it didn’t name the principle. Know every outside company that touches your data, because one of them is your weakest link. Retire the ancient VPNs rather than adding a shiny new layer beside them. Turn on a second login check everywhere, because the one account without it is the door that opens. None of it is about being stronger overall. It is about having no soft spot for the attacker to choose.

What the chain teaches about seeing the whole

There is a wider habit of mind here, and it reaches past security. We are drawn to measure ourselves and our systems by our strengths - the impressive parts, the things we’re proud of, the numbers that flatter. But think of anything where a single failure can bring down the whole: a supply chain, a levee, a plan, a body, a friendship kept up by only one of two people. There, the strength that decides the outcome is not the one you show off. It is the one you’d rather not look at.

That is an uncomfortable place to keep your attention. It means the honest question is rarely “what are we good at?” but “where are we thinnest, and who else does that thinness reach?” The Coca-Cola breach did not stay with Coca-Cola; it reached the people whose data Fairlife held. The Klue breach reached the customers of every firm that trusted it. A weak link is never only your own. It is a thread that runs out to everyone downstream of you - most of whom never chose your supplier and never saw the box you forgot to patch.

Seeing that should make the accounting harder, not easier. You cannot know, from inside your own fortress, where every one of your weak points is. Some of them live in companies you depend on, in code you didn’t write, in habits you can’t see because they’ve always worked so far. The chain holds until the day it doesn’t, and the link that breaks is usually the one nobody was watching.