Research shows 99 per cent of Global 2000 companies connected to supply chain breach

New research from SecurityScorecard and The Cyentia Institute identified 99 per cent of Global 2000 companies are directly connected to vendors that have had recent supply chain breaches.

Prompted by new SEC cybersecurity requirements demanding transparency around third-party breaches, this report highlights the escalating risk of multi-party supply chain attacks.

The interconnected nature of modern business means that a vulnerability in one part of the supply chain can have far-reaching consequences, potentially impacting the entire ecosystem. Massive third-party incidents like Change Healthcare, MOVEit and SolarWinds underscore the critical need for robust supply chain cybersecurity.

“While the Global 2000 boasts $51.7 trillion in revenue, their interconnectedness exposes them to severe cyber risks – with 99 per cent directly connected to breached vendors and incidents that can tally into the tens of billions,” said Wade Baker, partner and co-founder at The Cyentia Institute.

Key findings from the research include:

• 99 per cent of Global 2000 companies are directly connected to a supply chain breach.
• 20 per cent of these megacompanies use a thousand or more products.
• Supply chain incidents cost 17 times more to remediate and manage than first-party breaches.
• The estimated total losses from Global 2000 breaches ranged between $20 billion and $80 billion over 15 months.
• Global 2000 companies face significant concentrated risk due to their interdependence, with 90 per cent acting as vendors to each other.
• The Top 8 most widely deployed vendors are used by at least 80 per cent of Global 2000 companies, with four of the Top 5 reporting a recent breach.

The Forbes Global 2000 ranks the largest companies in the world using four metrics: sales, profits, assets and market value. The 2024 list accounts for $51.7 trillion in revenue, $4.5 trillion in profits, $238 trillion in assets and $88 trillion in market value. The analysis focused directly on the security posture and breach history of the Global 2000 and the ecosystem of third-party vendors surrounding each Global 2000 company to understand the nature of cyber risk across their supply chains.