The Short Version
A supply chain attack never touches your front door. The attacker compromises something you trust — a software package, a vendor portal, a managed service provider — and walks in with its credentials. SolarWinds proved the model at enterprise scale. The MALFEX npm campaign proved it works just as well against a 20-person company that runs npm install without checking.
The average cost of a supply chain compromise is $4.5M. You do not need an enterprise budget to defend against it. You need an inventory.
What Is a Supply Chain Attack, in 90 Seconds?
Three things you depend on, three ways in:
- Software you install. Packages, libraries, updates. The attacker poisons the thing itself — MALFEX hid a shellcode loader inside a pretend image decoder.
- Services you log into. Cloud tools, payment processors, managed IT. The attacker compromises the provider and inherits every customer’s session.
- Vendors who touch your systems. Contractors, support accounts, integrations. The attacker phishes the vendor and pivots into you.
One compromise, many victims. That leverage is why attackers love it.
Why Are SMBs the Sweet Spot?
Enterprises have vendor review boards, SOC teams, and contract leverage. A 30-person company has a CTO who approves vendors over lunch. Attackers know this.
The average SMB runs more than 300 third-party services — SaaS tools, plugins, contractors, open-source packages. Almost none of them have a vendor inventory, let alone a review process. And SMBs are the suppliers and partners of larger companies, which makes them a stepping stone: compromise the small vendor, pivot into the enterprise customer.
Which Five Controls Cost Under $500?
- Vendor inventory. A spreadsheet of every third-party service, who owns it, what data it touches. Free. Do it this week.
- Package vetting checklist. Five questions before any
npm install— maintainer history, issue activity, dependency depth, download anomalies, lockfile pinning. Free. See our npm vetting guide. npm auditin CI. Blocks known-vulnerable packages at merge time. Free with every major CI provider.- MFA on every vendor portal. Admin panels for your hosting, DNS, payment, and email providers get hardware-key or app-based MFA. A $50 key per admin.
- Contract security addendum. One page requiring breach notification within 24 hours and annual SOC 2 or equivalent evidence. A lawyer reviews it once, about $300.
Total: under $500 and a few afternoons.
What Does SolarWinds Teach an SMB?
SolarWinds was not a story about exotic tradecraft. It was a story about a trusted update channel with no verification. The lesson scales down perfectly: every auto-update, every vendor remote-access session, every shared credential is a SolarWinds-shaped risk in miniature. The fix is the same at every size — verify the channel, limit its access, monitor what it does.
What Does NIS2 Require?
NIS2 Article 21 makes supply chain risk management a legal obligation for covered entities: assess your suppliers’ security, include security in procurement, and coordinate vulnerability disclosure. Even if you are not directly in scope, your enterprise customers are — and they will pass the requirement down to you in contracts. A vendor inventory plus a documented review cadence satisfies most of what auditors ask for.
What I Tell My vCISO Clients
“List your top 20 dependencies. You will find at least three you forgot existed.”
Every engagement starts with the inventory because every engagement finds surprises — a contractor account from 2023 still active, a plugin with one maintainer, a SaaS trial that became production. Document the top 20, verify each one’s security posture, kill what you do not need. That single exercise stops most supply chain attacks aimed at SMBs.
Bottom Line
Supply chain attacks succeed because trust is assumed and never verified. Flip the default: inventory every dependency, verify the top 20, automate the rest. If your vendor list lives in someone’s head, book a review — we will build the inventory with you in a single session.
Common questions
What is a supply chain attack?
An attack that compromises your organisation through a trusted vendor, package, or service instead of targeting you directly — like the MALFEX npm package or the SolarWinds breach.
Why are small businesses targeted?
SMBs run 300+ third-party services on average with no vendor review process, making them easier footholds than well-defended enterprises — and a path into their larger customers.
What does NIS2 require for supply chains?
NIS2 Article 21 requires covered entities to assess supply chain security, including vendor risk management and coordinated vulnerability disclosure with suppliers.
