What Is a Supply Chain Attack?
Key takeaways
- A supply chain attack is a force multiplier: compromising one vendor can reach hundreds of customers who did nothing wrong and passed their own audits.
- SolarWinds in 2020 demonstrated the pattern, where a signed, trusted software update delivered a malicious payload into customer networks.
- In India the practical exposure is through managed service providers, payment processors, HR platforms and remote administration tools with privileged access.
- Due diligence only works if it is written down, because a questionnaire that is never completed or never revisited is a document rather than a control.
- Limit what a vendor can reach: scoped credentials, separate administration accounts, no standing remote access, and logging of every session.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is a supply chain attack and how does it work?
A supply chain attack compromises an organisation that your organisation depends on, so the attacker reaches you through a channel you already trust. The mechanism is usually not a broken product but a legitimate one: a malicious update, a tampered build, a compromised developer account, a poisoned software package, a contractor with access, or a managed service provider whose own network was breached. The same logic applies in India to a payment processor, an HR platform, a payroll vendor or a remote administration tool with standing access to your network.
Why do supply chain attacks work so well against Indian companies?
Because the trust is real and the visibility is thin. Vendors are given broad access because the work requires it, then that access is never reviewed, so a dormant account from a contractor who left in 2023 is still valid. Due diligence is often a questionnaire attached to a purchase order and never revisited. Many companies do not know how many suppliers can reach their network, because the list lives in email threads and an accountant's spreadsheet rather than in a register.
How do you assess a third-party vendor before you give them access?
Ask four things, in writing, and record the answers in a register you can produce. First, the security posture: what certifications or independent attestations exist, when were they last done, and can you see the report. Second, the access model: which systems, which accounts, what privileges, and is remote access standing or requested per job. Third, the incident obligation: how quickly will they notify you, and what will they hand over, including logs. Fourth, the subcontractor chain: who else touches your data, and where is it processed, which matters for your DPDP Act 2023 obligations. Test it, with a scoped vulnerability assessment of the vendor's environment and a joint incident exercise with your own team.
What limits the damage when a vendor is compromised?
Design the relationship so the blast radius is small. Give every vendor a named account, never a shared one, and scope its permissions to the specific job, with the smallest set of data and the shortest sensible life. Remove standing remote access and use just-in-time, time-bound elevation with a named approver on your side, and separate the administration accounts you use from the ones the vendor uses. Require that vendor sessions are logged, and review those logs, because a supplier's log is often the only record of the intruder. Put contractual hooks in place: a notification window measured in hours, audit rights, the right to receive logs on demand, and the right to terminate.
| Layer | What you check | Artefact to keep | Frequency |
|---|---|---|---|
| Inventory | Which suppliers can reach systems or data | Supplier register with access ranking | Continuous, review quarterly |
| Due diligence | Attestations, questionnaire, breach history | Completed assessment per supplier | At onboarding, then annually |
| Access control | Named accounts, least privilege, no standing remote access | Access matrix and offboarding records | Quarterly review |
| Contractual terms | Notification window, audit rights, log supply, exit | Signed data processing and security annex | On every renewal |
| Technical testing | Scoped assessment of the vendor environment | Test report and remediation plan | Annually for critical vendors |
| Monitoring | Vendor sessions, alerts, restored access review | Quarterly access and log review report | Quarterly |
What are the frequently asked questions?
Get a straight answer on this
Send us your supplier list and who holds privileged access, and we will return a fixed-price third-party risk assessment with the register template and the questionnaire we use.
Send us the details See pricing