A recent report highlighted that nearly a third of business leaders have seen an increase in cyber attacks targeting their supply chains. The focus, understandably, has been on supplier concentration, third parties and the domino effect when one partner falls. This concern is valid, but it’s incomplete.
There is another supply chain risk that rarely makes it to the agenda of board. It doesn’t arrive through a vendor contract and is not listed in a procurement register. It’s also not captured in a due diligence questionnaire. The risk is open source software.
