A new global Kaspersky study has identified the lack of qualified IT security workers (40%) and the need for global organizations to prioritize various security tasks to mitigate the risk of supply chain and trusted relationship attacks (47%), cited by respondents in the UAE.
Kaspersky’s recent study on supply chain and trusted relationship risks showed that supply chain attacks have emerged as a top threat for businesses, with every third organization hit by such an attack over the past year. The severity and frequency of supply chain attacks necessitate uncovering the key reasons preventing them from addressing the risks successfully.
According to the survey, one of the key barriers to reducing supply chain and trusted relationship risks is the lack of a qualified workforce. This shortage leaves organizations without the capacity to consistently access and monitor possible third-party vulnerabilities across their ecosystems. Among other primary obstacles, respondents noted the need to juggle multiple cybersecurity priorities. This reflects the fact that security teams are stretched across too many tasks at once, which might leave supply chain threats unaddressed.
Beyond resource constraints, respondents also point to structural issues: 37% say their contracts lack clear IT security obligations for contractors. Further 38% note that nonIT security staff often do not fully understand these risks.
Globally, according to the survey, an overwhelming 78% of businesses admit their organizations need to upgrade protection against supply chain and trusted relationship risks, with only 22% of enterprises considering their current security measures effective.
At the same time, the results of the survey showed that current mitigation practices for third-party risks remain fragmented, with no way of protection getting more than 40% of current adopters. Even the most common protective measure, two-factor authentication, is used by only 40% of respondents. In addition, only 38% of organizations conduct regular reviews of contractors’ cybersecurity postures. As a result, nearly two thirds of businesses lack ongoing visibility into the security of their partners, leaving them exposed to evolving vulnerabilities across their ecosystems.
It’s noteworthy, that companies that have already experienced supply chain and trusted relationship attacks, tend to adopt stronger security habits. Global results have shown that those hit by supply chain incidents are more likely to request penetration test results (56%), while victims of trusted relationship breaches prioritize checks on compliance with industry standards (56%) and their contractors’ own supply chain policies (53%).
“When security teams are overstretched, understaffed and have to prioritize urgent tasks over long term resilience priorities, organizations are left exposed to threats that can move silently through their provider ecosystem. To break this cycle, the industry needs to adopt more unified and consistent mitigation strategies, from standardized contractor assessments to stronger cross‑team awareness. Supply chain security should become a shared, enforceable responsibility across the entire business network,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.