Cybersecurity supply-chain risk management is the process of identifying, assessing, and reducing cyber risk across the suppliers, products, and services an organization depends on. It treats vendors, cloud platforms, software components, and managed service providers as part of the security boundary, because a weakness in one of them can create exposure for many customers at once.
This matters because attackers often target the supply chain to bypass well-defended internal systems. Common examples include compromised software updates, stolen vendor credentials, insecure remote support, and vulnerable third-party services. Strong programs map critical dependencies, classify suppliers by business impact, review secure development and patch practices, require incident reporting, and test continuity plans. In defense, supply-chain risk management helps limit blast radius, detect inherited vulnerabilities, and keep essential services running when a supplier fails or is compromised.