The Illusion of Resilience
Are We Creating Hidden Supply Chain Risk?
The Illusion of Resilience
Modern organisations increasingly rely on interconnected ecosystems of suppliers, subcontractors, outsourced services and inherited trust relationships. This model may be transformational, but if organisations fail to understand the dependencies beneath it, the operational impact and blast radius of compromise could be significant. Most business leaders are familiar with the idea that disruption to third party providers can cause system outages, an inability to deliver core services and lead to regulatory non-compliance, ultimately affecting the bottom line of a business.
In order to remedy this, for years organisations have been encouraged to diversify suppliers to improve resilience, reduce dependency and strengthen operational continuity. On paper, it makes perfect sense.
- Don’t rely on a single provider
- Split services across multiple suppliers
- Distribute risk geographically
- Increase SME involvement
- Improve social value outcomes.
Risk registers then reflect a lower dependency position, and procurement strategies demonstrate resilience through diversification. Assurance processes conclude concentration risk has been lowered to an acceptable level.
However, a hidden issue sits one layer down: fourth-party concentration risk.
This is where multiple suppliers, who appear independent to the contracting organisation, depend on the same small set of downstream providers, platforms or components. In practice therefore, it is possible to have commercial diversification, but operational consolidation.
In some cases, we may even be unintentionally creating it ourselves.
The Modern Attacker No Longer Looks Like a Burglar
Traditional cyber security models focused heavily on keeping attackers out – firewalls, perimeter controls, physical security and technical controls, etc. The attacker was viewed as an outsider attempting to force entry into the organisation. That model still matters, but modern attacks increasingly look very different.
Today’s attackers often arrive wearing an approved supplier badge. Rather than attempting to defeat hardened perimeter controls, attackers increasingly compromise trusted suppliers, inherit legitimate access and abuse established trust relationships to move through interconnected environments. The National Cyber Security Centre (NCSC) has repeatedly identified supply chain compromise as one of the most prominent modern attack vectors.
Recent incidents have shown how quickly the compromise of one trusted supplier cascades downstream. In mid-2024, attackers accessed roughly 165 Snowflake customer tenants, including AT&T, Santander and Ticketmaster. The route in was not Snowflake itself but credentials stolen from third parties[1].
In May 2026, the same group, ShinyHunters, returned and compromised Canvas, the learning management platform used by around 8,000 institutions worldwide[2].
Closer to home, the Qilin ransomware attack on Synnovis in June 2024 cancelled more than 10,000 NHS appointments and depleted blood stocks across London hospitals. It has since been formally linked to a patient’s death[3].
The same concentration risk plays out even without an attacker. In July 2024, a faulty CrowdStrike update took 8.5 million Windows machines offline and disrupted airlines, banks, hospitals and broadcasters worldwide[4].
This shifts the question from “is this supplier safe?” to “what does this supplier rely on, and how does that dependency affect us?”
Diversified Supplier, Shared Dependencies
Many organisations deliberately appoint multiple suppliers to create resilience. A sensible strategy. At first glance, dependency risk appears reduced. But look a layer deeper and a different picture can emerge. It is increasingly common for separate suppliers to rely on the same:
- Offshore development partner
- Managed service provider (or the same subcontracted NOC/SOC)
- Cloud platform
- Specialist subcontractor
- IAM platform
- Niche software component
- Operational tooling provider (monitoring, patching, ticketing).
Example 4th Party Concentration Risk
From a governance perspective, business leaders and board level executives may believe that their organisation has several independent supply routes. In reality, those suppliers may share a single, concentrated dependency ecosystem. Their supplier diversity does not necessarily equal dependency diversity.
An example helps illustrate this. An organisation could appoint three independent cyber consultancies. If all three turn out to subcontract their out-of-hours monitoring to the same managed SOC, one ransomware incident at that SOC could have a huge impact. It can become widespread service degradation, exposure to secondary security compromise from three different providers, and an inability to keep important business services within tolerance. Contractually, business leaders may then find themselves dealing with simultaneous SLA breaches and accompanying service credit claims across three contracts, with multiple incident notification obligations from regulators firing at the same time. The concentration risk was never visible at the contracting level.
This issue is particularly relevant where suppliers use shared cloud platforms, and common subcontractors that provide privileged services across multiple customers. None of these are inherently unusual, but it means that contracting organisations may have limited visibility of the associated concentration risk.
Concentration risk also hides in a second form, this time inside the organisation rather than outside it. Supply chain risks are often assessed in isolation, by different business units or by different Senior Responsible Owners (SROs). Each may rate the same supplier as Medium Risk within its own scope and service. When those local assessments are aggregated, the same dependency may quietly support several critical services, each with high operational impact. What looks acceptable in a local context can become unacceptable at an organisational level. This is where modern supply chain governance becomes significantly harder.
When Assurance Becomes a Checkbox Exercise
Most organisations cannot deeply assess every supplier, and it would be unrealistic to try. Supply chain assurance must remain pragmatic, proportionate and risk based. The problem is that, in many organisations, supplier assurance still leans heavily on artefacts that while useful, often do not fully account for this fourth-party concentration risk:
- Insurance validation and basic corporate checks
- Contractual compliance and ICO registration
- Financial standing
- Certifications and questionnaire responses.
A supplier can meet requirements on paper while still carrying problems: fragile dependencies, weak subcontractor governance, excessive privileged access, immature detection and response, limited ability to contain an incident, and hidden downstream concentration risk.
Technology can reinforce this dynamic. Third-party risk management (TPRM) tooling and dashboards can support oversight, but this should not be mistaken for effective governance. A questionnaire does not automatically create understanding, and a dashboard does not automatically create effective visibility of fourth-party exposure.
The Visibility Challenge
The reality is that complete visibility across modern supply chains is extremely difficult. No organisation possesses the resources to exhaustively assess every supplier and subcontractor to the deepest possible level. Nor would that be commercially or operationally practical. The challenge for board level leadership is therefore not eliminating concentration risk entirely. The challenge is understanding where material concentration exists, where operational dependency becomes critical, and where trust relationships may create disproportionate exposure. This requires organisations to move beyond purely compliance-led assurance models and place greater emphasis on:
- Service criticality and operational dependency.
- Downstream visibility of fourth-party providers.
- Common platforms and shared provider ecosystems across separate suppliers.
- Aggregate organisational exposure, with a focus on dependencies that support multiple critical services.
In many cases, the greatest risk may not sit with the large strategic supplier everyone is watching, but a less visible downstream provider.
Questions Worth Asking
A useful starting point is for your organisation to start asking different questions. Which of your suppliers share an offshore development partner? Which rely on the same privileged remote access platform, managed SOC, or identity provider? If three of your most critical suppliers were disrupted tomorrow morning, what would they have in common? These questions matter because they shift the assurance conversation away from individual suppliers and towards the dependencies those suppliers share.
The more important follow-on questions are: What do senior leaders do to address this? And how can they start treating shared supplier dependencies as an enterprise resilience issue?
The response should be practical. Map the suppliers, subcontractors, platforms and data flows that support your organisations critical services. Aggregate that view across business units so common dependencies can be seen. Maintain a shared dependency register for high-impact services, update contracts to require visibility into subcontractors and incident support, and make efforts to discuss concentration risk in governance forums as an enterprise risk issue.
This approach can take a hefty amount of work, but will put business leaders in good stead to better understand and address concentration risk within their organisation. It will also help prepare for the future direction of the industry, with both NCSC guidance and the upcoming UK Cyber Security and Resilience Bill placing increasing emphasis on the criticality of high-impact suppliers.
The next major operational disruption may not come from a supplier failure a business can see, but from a dependency they never realised they shared.
If your organisation would benefit from support in identifying, mapping and governing shared supplier dependencies, please get in touch via sales@amethystrisk.com We would be happy to discuss a practical approach tailored to your organisation.
[1] Snowflake data breach – Wikipedia
[2] 2026 Canvas security incident – Wikipedia