Loading story…
New research highlights that technology providers serving the financial sector often have weaker cybersecurity postures than the financial institutions themselves, exposing banks and trading platforms to significant hidden risks. BitSight's analysis of over 41,000 financial organizations and 50,000 supplier relationships revealed that suppliers underperform in 16 out of 22 risk categories, particularly in vulnerability management and exposure, despite better scores in email and domain security. The study identified both well-known and lesser-known suppliers as critical to the sector's operations, emphasizing the complexity and opacity of the digital supply chain and the potential for overlooked vulnerabilities to become major points of failure.
The findings underscore the urgent need for financial organizations to scrutinize their third-party technology providers and strengthen supply chain risk management practices. As dependencies on external vendors grow, the attack surface expands, making comprehensive vendor risk assessments essential for maintaining cyber resilience. The research calls attention to the "hidden pillars" of the financial sector's digital ecosystem, whose security gaps could have cascading effects if exploited by threat actors.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A *Panorays* survey of 200 U.S. CISOs reported rising **third-party security incidents** alongside major visibility gaps across extended vendor ecosystems. In the findings cited by Help Net Security and SC Media, **60%** of CISOs said third-party incidents increased over the past year, while only **15%** said they have full visibility into third-party risk across deeper supply-chain tiers (third-, fourth-, and beyond). The reporting emphasizes that vendor dependencies now span core functions (cloud, software development, data processing, and AI services), expanding attack surface and enabling attackers to exploit less-monitored downstream relationships such as subcontractors and affiliates. The survey also pointed to weak preparedness and governance as compounding factors: while **77%** of CISOs view third-party risk as a major threat, only **21%** reported having tested crisis response plans, and only **41%** monitor risk beyond direct suppliers. Both articles highlight **unmanaged/“shadow” AI tools** as an emerging third-party risk driver, with only **22%** of organizations having formal AI vetting processes and **60%** of respondents identifying shadow AI as uniquely risky—creating new, poorly understood pathways for supply-chain compromise and regulatory exposure.
Jun 29, 2026
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026
A recent ISC2 survey of over 1,000 cybersecurity professionals highlights growing concern about the risks introduced by expanding vendor ecosystems and supply chain sprawl. Nearly 70% of organizations are worried about third-party supplier risks, with the highest concern in enterprises and sectors handling sensitive data such as finance and government. Lack of visibility into vendor and subcontractor security practices remains a critical challenge, with many organizations relying on trust rather than verification. One in three respondents reported experiencing a vendor-related security incident in the past two years, yet almost half did not feel a direct impact, raising questions about continuity and the reliability of vendor security claims. Compounding these risks, a Sonatype analysis reveals that the vulnerability scoring infrastructure, particularly the NVD and CVE programs, is failing to keep pace with modern software development practices. In 2025, 64% of open source CVEs lacked a CVSS score in the NVD, forcing security teams to make risk decisions with incomplete data. Discrepancies in severity ratings and significant delays—averaging six weeks between disclosure and scoring—undermine the effectiveness of automated security tools and response cycles. These gaps in both supply chain visibility and vulnerability intelligence are eroding confidence in the data that underpins security programs, increasing the likelihood of both missed threats and wasted resources.
Jun 29, 2026