Supply-chain security: find hidden supplier links

Supply-chain security is the practice of managing the cyber risk that comes from the suppliers, products and services your organisation depends on. In practice, the biggest exposure is rarely the software vendor you assessed. It is the supplier you never thought of as a cyber risk: the company that installed a refrigeration unit, a production machine, a building management system, or a camera, and left a way in.

The question that exposes the problem is simple: who in your organisation knows which supplier equipment is reachable from the internet, or connected to your network, right now?

In most organisations the honest answer is: nobody in IT or security. Picture a retail chain whose refrigeration controllers are reachable from the internet through a maintenance connection the installer opened years ago. An attacker who reaches them can push the temperature setpoint far beyond safe limits, and a store’s entire stock is lost within hours. Nobody in IT knew the controllers were exposed, because they were never IT assets. They were cooling.

That is the core of supply-chain security: the problem is visibility and ownership, whatever the equipment. The same gap exists in almost every organisation, just with different machines.

This guide explains how these blind spots come to exist, and gives you five practical steps to close them, plus a short FAQ at the end. It needs no new tooling to start.

How a fridge ends up on the internet without anyone deciding it

Nobody wakes up and decides to expose a refrigeration controller. It happens through a chain of perfectly reasonable steps:

An installer puts the equipment in and opens remote access, so they can do maintenance without driving out.
Facilities signs the contract. It is a service contract for cooling, not an IT purchase.
The device sits outside the corporate network, so no vulnerability scan ever finds it.
It never makes it into the asset inventory, because it is not an IT asset.
The supplier never reaches a third-party risk review, because on paper they sell cooling, not software or data.

Every step makes sense to the person taking it. The result is a device with a remote way in, run by a supplier you never assessed, on a connection nobody in security knows exists.

We see this pattern at clients on a regular basis. It is rarely the fridge. It is manufacturing equipment and machines, building management systems, industrial scales, cameras, access control, HVAC, elevators. Each comes with the supplier’s own way in, often a 4G router or a cloud portal that nobody in IT has ever looked at.

The core issue: every connection made sense to whoever ordered it, and nobody holds the full list.

1. Map every supplier, not just the IT ones

Start with the full list: everyone who delivers a product, a machine or a service to your organisation. The approved-vendor list from procurement and the software list from IT each cover only part of it.

Include the ones that “only” deliver a machine or a service. The coffee machine supplier, the company that maintains your production line, the firm that services the building’s heating. Then ask each of them one question: what of yours connects to us, or to the internet, on our behalf?

The answers are often uncomfortable, and they tell you where to look. Check for:

Remote maintenance access, VPNs, or jump hosts the supplier uses
Cellular (4G/5G) routers or gateways installed with the equipment
Cloud portals where the supplier monitors or controls the device
Accounts the supplier holds in your systems, and who still uses them

Practical tip: start from three sources and merge them: the accounts payable list (who do we pay?), the contracts register (who did we sign with?), and facilities and operations (who comes on site?). The gaps between those three lists are where the surprises live.

2. Link every supplier to a business process

A list of suppliers tells you who is out there. It does not tell you what matters. For that, connect each supplier to the business process it supports and ask: what stops if this supplier, or their connection to us, is compromised?

For a supermarket whose refrigeration supplier is compromised, the answer is stock, revenue and food safety, within hours. For your organisation it might be a production line, a warehouse, a building’s access control, or a billing run.

Keep it simple. For each supplier, record:

The business process or service it supports
What happens, and how fast, if it goes down or is manipulated
The business owner on your side (a name, not a department)
How the supplier connects, and to what

This does two things. It lets you rank suppliers by real impact instead of by contract value. And it gives you a business owner who can answer questions and accept risk, which is the part most security teams are missing.

3. Offer one route for remote access, and make everyone use it

If every supplier brings their own way in, you will never have control. Suppliers need remote access, often for good reasons, so banning it rarely works. Offer one route and make it the only one.

That route should work the same for IT, IoT and OT, and it should have these properties:

Approved per session. Access is requested, approved by a named person, and time-limited. Standing access is the exception.
Logged. You know who connected, to what, when and for how long. Ideally session recording for anything critical.
Strong authentication. Individual accounts with MFA, no shared logins, no default credentials.
Segmented. The supplier reaches the one system they maintain, not the network behind it.

Then the hard part: enforcing it. Put it in contracts for new deals and renewals. For existing equipment, find the supplier-installed 4G routers and cloud connections from step 1, and move them behind the controlled route or switch them off. A supplier who refuses to use your route is telling you something about their security.

4. Get cyber into the room when the business buys

The cheapest moment to fix a supplier connection is before the installer arrives. After that, it is a retrofit, an argument, and a downtime window.

You do not need a heavy process. A short checklist in procurement catches most of this. If the purchase involves any equipment or service that is connected, or that the supplier will maintain remotely, ask:

What connects? Does the product connect to our network, to the internet, or to the supplier’s cloud? How (wired, Wi-Fi, 4G)?
Who gets in? How does the supplier access it for maintenance, and can they use our remote access route?
What are the defaults? Are default credentials changed at installation? Are unused services and ports closed?
How is it updated? Who patches it, how often, and for how long will the supplier support it?
What if it goes wrong? Does the supplier notify us of incidents, and within what timeframe? What happens to our data and devices at contract end?
Who owns it? Which business owner is responsible, and has the device been added to the inventory?

Make two rules around it. Procurement and facilities cannot sign without the checklist. And a purchase that fails the checklist goes to security for a decision, not to the installer for a workaround.

This is also where regulation points. NIS2 and similar frameworks expect you to manage cybersecurity risk in your supply chain. A documented checklist and an inventory are exactly the evidence an auditor will ask for.

5. Keep the picture current

Last year’s supplier list says very little about what is connected today. Suppliers change, equipment gets replaced, someone adds a camera, a contractor installs a new gateway. A one-off inventory is out of date the day you finish it.

Build the refresh into things that already happen:

Procurement and onboarding: every new supplier or connected device updates the register as part of the purchase.
Quarterly review of critical suppliers: has anything changed in how they connect, who has access, what they deliver?
Access reviews: supplier accounts and remote access paths are checked and cleaned up on a fixed rhythm.
Technical discovery: periodically scan for what is actually reachable from the internet and what talks to unknown external destinations. Compare it to the register. Every difference is a finding.
Offboarding: when a contract ends, access ends. Verify it.

The last two are the reality check. The register tells you what you think is connected. Discovery tells you what actually is.

Supply-chain security FAQ

What is supply-chain security? It is managing the cyber risk created by everything and everyone you depend on: software vendors, service providers, and suppliers of machines, equipment and connected devices. It covers who connects to you, what they can reach, and what stops if they are compromised.

Why are non-IT suppliers a security risk? Suppliers of machines, building systems and equipment often install their own remote access, such as a 4G router or a cloud portal. These connections are usually arranged by facilities or operations, sit outside the corporate network, and never reach the asset inventory or a third-party risk review.

What is the first step in supply-chain security? Build a complete supplier list, including suppliers that only deliver a machine or a service, and ask each one what of theirs connects to you or to the internet.

How should supplier remote access be handled? Offer one controlled route for all suppliers and all environments (IT, IoT and OT): approved per session, logged, protected with MFA, and limited to the system the supplier maintains.

What should a procurement security checklist cover? What connects, who gets in, default credentials, how the product is patched and for how long, how incidents are reported, and who owns the device internally.

How often should supplier connections be reviewed? Critical suppliers at least quarterly, supplier access on a fixed review rhythm, and technical discovery of internet-facing and supplier-connected devices on a regular schedule, compared against the register.

Which regulations require supply-chain security? NIS2, DORA, ISO 27001 and similar frameworks all expect organisations to manage cybersecurity risk in their supply chain. A supplier register, risk assessments and documented access control are the evidence auditors ask for.

Takeaways

If you read nothing else, take these with you:

Your supply chain is bigger than your IT vendors. Anyone who delivers a machine or a service with a connection to it is part of your attack surface.
If it is not in the inventory, nobody is protecting it. Devices outside the corporate network are the ones that get missed.
Know what stops. Link every supplier to a business process and a named owner.
One door, not twenty. One logged, approved route for supplier remote access, for IT, IoT and OT alike.
Fix it at the purchase, not after the install. A short procurement checklist beats a retrofit every time.
Treat it as a process, not a project. A supplier list from last year tells you little about today.

And a concrete exercise for Monday: run the supplier inventory and count the connections your security team has never seen. Whatever the number is, it is higher than you expect.

How Secamo helps

Most organisations agree with everything above and still do not get it done. The inventory is a big job, the supplier questions are awkward, and the process needs someone to own it every month, not once.

That is what we do at Secamo. We help clients set up supply-chain security management that works in practice, and we run it for them as an ongoing service:

Supplier inventory: we set up the process to build and maintain your supplier inventory, including the suppliers that only deliver a machine or a service, and to capture what of theirs connects to you.
Risk assessment: we link suppliers to your business processes, rank them by real impact, and assess the ones that matter.
Controlled remote access: we help you design one approved, logged route for supplier access across IT, IoT and OT.
Procurement integration: we embed cybersecurity into your procurement process, with clear roles and hand-offs, so cyber is involved before the installer arrives.
Monitoring: we keep the picture current, with periodic reviews and discovery of what is actually connected today.
Regulatory fit: the output supports your ISO 27001, NIS2 and similar supply-chain obligations.

You can take the framework and run it yourself, or have us run it on your behalf, from the first inventory to continuous monitoring.

Want to know how many supplier connections your security team has never seen? Get in touch with Secamo and we will help you find out.

Supply-chain security: how to find and control the supplier connections nobody knows about