Supply chain attacks are evolving rapidly, exposing critical weaknesses in how financial institutions manage vendor risk. Experts warn that trust relationships, poor integration between risk and security, and delayed detection are enabling attackers to mo
Supply chain attacks are no longer
peripheral threats to financial institutions. They are becoming the primary
pathway through which attackers gain access to critical systems, exposing
structural weaknesses in how banks manage trust, third parties, and cyber
defense.
At CeFPro’s recent Vendor Risk USA
conference event, speakers from a cybersecurity firm highlighted how attacks
are shifting in both scale and sophistication, with financial institutions
increasingly targeted through their vendor ecosystems rather than direct
intrusion.
Their central message was clear:
traditional approaches to third-party risk management are no longer sufficient.
A senior executive at a cybersecurity
provider warned that the industry is underestimating the pace of change.
“We’ve had a lot of supply chain
attacks, particularly in the UK recently,” the executive said, noting that
financial services firms are seeing a growing number of breaches originating
beyond their own perimeter.
This trend is supported by stark
data. According to a senior solutions architect at the same firm, “60% of
breaches originate outside of the perimeter, so from the supply chain,” underlining
the extent to which third-party relationships are now a primary attack vector.
The role of artificial intelligence
is accelerating this shift. The same expert pointed to a dramatic rise in
AI-enabled phishing attacks, noting a “180%” increase year over year.
These attacks are becoming more
convincing, more scalable, and more difficult to detect, allowing threat actors
to compromise vendors and pivot into client environments with increasing ease.
What makes supply chain attacks
particularly dangerous is not just how they begin, but how long they persist
undetected.
The speakers highlighted that the
median dwell time for attackers in such incidents is around 15 days. During
this period, attackers can move laterally, deploy backdoors, and exfiltrate
sensitive data without triggering alerts.
The root cause lies in trust. Vendor
connections are often pre-approved and whitelisted within client environments,
meaning malicious activity can appear legitimate.
As the solutions architect explained:
“Quite often these breaches result from a trust - trust relationship… it’s
generally not picked up by the SOC, and they can just roam around the
environment and essentially do what they want.”
A case study presented during the
session illustrated the real-world consequences. In one example, a retail bank
outsourced its IT help desk to a regional provider.
