* [![perspectives](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2025/02/prespective-icon.png)](https://www.paloaltonetworks.com.au/perspectives)
* Tip of the Iceberg: The Hidden Scale of Europe's Supply Chain Cyberthreat

# Tip of the Iceberg: The Hidden Scale of Europe's Supply Chain Cyberthreat

![Tip of the Iceberg: The Hidden Scale of Europe’s Supply Chain Cyberthreat](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/01/tip-of-the-iceberg-featured.jpg)  
**By [Chris George](https://www.paloaltonetworks.com.au/perspectives/author/chris-george/ "Posts by Chris George")** | **6 min read** |  
![share icon](https://paloaltonetworks.com/content/dam/pan/en_US/cxo-perspectives/images/cxo-share.svg)

* LinkedIn button ![linkedin-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-linkedin.svg)
* Twitter share button ![twitter-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-twitter-x-black.svg)
* \[Email share button ![email-icon](https://www.paloaltonetworks.com/content/dam/pan/en_US/microsite/cortex/images/share-email.svg)\](mailto:?subject=Tip of the Iceberg: The Hidden Scale of Europe’s Supply Chain Cyberthreat\&body=Check out this article https%3A%2F%2Fwww.paloaltonetworks.com.au%2Fperspectives%2Ftip-of-the-iceberg-the-hidden-scale-of-europes-supply-chain-cyberthreat%2F "Share in Email")
* ![copy-icon](https://www.paloaltonetworks.com.au/perspectives/wp-content/themes/csp2025/dist/images/icons/icon-share.svg)
  [](https://www.paloaltonetworks.com.au/perspectives/tip-of-the-iceberg-the-hidden-scale-of-europes-supply-chain-cyberthreat/?pdf=download&lg=en&_wpnonce=09d9627581 "Click here to download") MEET THE AUTHOR  
  ![](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/01/Chri-George-Headshot.png)  
  A distinguished cybersecurity expert with 20+ years of experience, Chris leads Unit 42, Palo Alto Networks' threat intelligence and incident response arm. Its team of threat researchers and incident responders are trusted strategic advisors to businesses and their Chief Information Security Officers (CISOs) around the globe. Chris is an established thought leader, and a trusted figure in the cybersecurity space with specialist knowledge on topics such as Incident Response, Security Operations, Threat Intelligence, Adversary Emulation, and Continuous Threat Exposure Management. Before joining Palo Alto Networks, Chris Director of Cyber for Deloitte UK. Prior to this, he held varied leadership positions at leading businesses in the cybersecurity industry such as Munich Re, AXA, PWC and Centrica....

[Learn more](https://www.paloaltonetworks.com.au/perspectives/author/chris-george/)

## IN THIS ARTICLE

When we're called in to investigate a cyber incident, most organisations focus on one thing --- getting back online quickly. That's understandable because operations stop, customers must wait, and the pressure is immense. But what's often overlooked in the urgency of recovery is the initial entry point of the attacker.

In nearly one-third of the European incidents Unit 42^®^ investigated over the past year, the breach began inside an organisation's supply chain. These attacks exploit a supplier, a partner or a service provider to reach the real target. This finding, however, doesn't factor in that most of these attacks are never reported as supply-chain incidents because tracing the origin requires time and resources that few have. The result is a dangerous blind spot.

Other data shows that the supply chain threats are rising fast, with estimates of a [100% YoY increase](https://www.verizon.com/business/resources/articles/s/what-the-2024-dbir-tells-us-about-enterprise-cybersecurity-strategy/). And, they are appearing as the [no. 2 emerging](https://www.paloaltonetworks.co.uk/resources/research/2025-incident-response-report) threat. The true scale is far greater than any reporting will show.

## The Weakest Link Principle in Action

Today's enterprises depend on vast digital ecosystems. Each one connects to hundreds, sometimes thousands, of third-party suppliers. Every connection --- an API, a shared database or a remote maintenance tool --- is a potential doorway.

Attackers know this. They don't need to batter down a heavily defended front gate when a side door is wide open. Smaller suppliers often lack the layered defences or monitoring that large organisations regard as a minimum standard. A single compromise in a trusted vendor can cascade through the entire network.

We've seen this play out in striking ways. During a global sporting event, a compromised content provider allowed hackers to hijack commercial screens across a major European city, pushing propaganda at scale. In another case, attackers breached the CCTV infrastructure of a pharmaceutical company, creating remote access to sensitive R\&D facilities. And another attack was far more targeted and nefarious. The attackers hid a Trojan in a digital car sales flyer that reached embassy staff in Ukraine via an everyday notice board. Each one started with a trusted supplier and ended with a significant downstream breach.

## Why the Threat Is Accelerating

Several forces are converging to make supply-chain compromises the attack vector of choice.

The first is economic asymmetry. The cost to launch an attack is far cheaper than the cost to defend against them. Breaching a small supplier with weaker defences is easier and costs an attacker little more than time and patience, while defending a global enterprise obviously requires massive investment. The payoff for this patience can be huge. It takes just one successful supplier breach to unlock access to multiple downstream targets.

The second is AI acceleration. Threat actors now use AI-driven reconnaissance tools to scan the internet to map who connects to whom and identify potential supply chain weaknesses. With ransomware as a service and access brokers selling credentials on demand, the barrier to entry has never been lower.

For example, such groups as Muddled Libra (also known as Scattered Spider) use these tools with devastating effect. In one incident we investigated, a business-process outsourcing firm faced five separate attacks in a single week. Each one attempted to exploit a different route through its partner network.

Finally, digital overextension is multiplying the attack surface. Every new SaaS integration, data-sharing partnership or outsourced process adds complexity and dependency. As ecosystems grow, visibility diminishes, and unseen risk thrives in the shadows.

## How a Supply Chain Attack Unfolds

The anatomy of these attacks is increasingly familiar. It begins with reconnaissance. Automated scanning is used to find outdated software, exposed credentials or misconfigured services in third-party systems. Once inside, the attacker studies the environment, looking for connections to higher-value organisations. The supplier is rarely the end goal, but rather the stepping stone.

From there, the attacker moves laterally. They might use stolen credentials to access shared cloud storage or embed malicious code in a software update. Eventually, they reach a target that holds sensitive data or operational control. Extortion follows, often a threat to leak data, disrupt operations or report the breach to regulators to trigger fines and reputational damage.

## Who's Being Targeted?

The most frequent targets that we've observed are in high-tech and financial services. These sectors handle valuable data and depend on an array of vendors. But they're not alone. Law firms and professional services providers, both rich in confidential client material, have become prime targets due to their connections to blue-chip enterprises. Luxury brands are also on the list, often attacked indirectly to reach the personal data of high-net-worth clients.

Besides following the money, attackers are following connectivity. The more an organisation interacts with others, the more routes exist to reach it.

## The Case for Cyber Altruism

Traditional security thinking stops at the enterprise boundary. We protect what we own and manage. But that approach no longer works when exposure extends across hundreds of suppliers.

Unit 42 advocates for "cyber altruism" --- the idea that larger organisations should extend enterprise-grade protection, tooling and expertise downstream to smaller partners. Cyber altruism is enlightened self-interest. Every weak link in your supply chain is a potential breach in your own.

Cyber altruism means mapping dependencies, identifying weak links and sharing security. It might involve providing smaller vendors with access to secure file-transfer tools, threat-intelligence feeds or incident-response playbooks. Or, it can mean including minimum security standards in contracts or offering cofunded training. Anchor enterprises typically lead this work, since they have the most to lose if a partner is breached.

When done well, the benefits are collective. Risk is reduced across the ecosystem, resilience improves and trust deepens. Organisations that take this approach are also likely to gain competitive advantage. Customers and regulators increasingly expect visible due diligence on supply chain security.

## A Shared Responsibility

Supply chain security cannot rely on disclosure alone. Under-reporting will continue as long as investigations prioritise restoration over origin. But we can change what happens next.

Leaders should start by asking three simple questions:

* **Do we know every digital dependency we have?** Map suppliers, partners and service providers, however small.
* \*\*Where are the weak links?\*\*Assess vulnerabilities and fix them before adversaries do.
* **How are we supporting our ecosystem?** Extend safeguards and knowledge to those who need it most.

The reality is that one weak link can compromise an entire ecosystem. Recognising that interdependence is the first step toward resilience.

## Looking Ahead

The growth of connected supply chains has transformed how business is done, but it has also created a perfect storm for attackers. Economic imbalance, rapid AI adoption and endless digital interconnections have tilted the field in their favour.

Rebalancing it requires technology and demands collaboration, visibility and shared accountability. Cyber altruism captures that mindset --- pragmatic, collective and focused on protecting everyone who depends on the chain.

We can't fix what we can't see. But, once we look beyond the tip of the iceberg, we can start strengthening what lies beneath.

Read the Unit 42 Global Incident Response Report [here](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report-social-engineering-edition).

* [AI](https://www.paloaltonetworks.com.au/perspectives/all-articles/?cat=ai)
* [Staying Ahead of Evolving Threats](https://www.paloaltonetworks.com.au/perspectives/all-articles/?cat=staying-ahead-of-evolving-threats)

## Related Content

![](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/Securing-the-Wrong-Layer-featured.jpg) BLOG

### Staying Ahead of Evolving Threats

**Cybersecurity in 2026: What we predicted, what surprised us, and what's next**

At Palo Alto Networks, we are privileged to sit at the intersection of cybe...

[Haider Pasha](https://www.paloaltonetworks.com.au/perspectives/author/haider-pasha/ "Posts by Haider Pasha")
[](https://www.paloaltonetworks.com.au/perspectives/cybersecurity-in-2026-what-we-predicted-what-surprised-us-and-whats-next/)  
![](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/Why-Cybersecurity-KPIs-Are-Changing-featured.jpg) BLOG

### AI

**Why Cybersecurity KPIs Are Changing (And What This Means for Security Leaders)**

True cyber resilience is impossible to achieve without strategic and tactic...

[Helmut Reisinger](https://www.paloaltonetworks.com.au/perspectives/author/helmut-reisinger/ "Posts by Helmut Reisinger")
[](https://www.paloaltonetworks.com.au/perspectives/why-cybersecurity-kpis-are-changing-and-what-this-means-for-security-leaders/)  
![](https://www.paloaltonetworks.com.au/perspectives/wp-content/uploads/2026/03/Weaponized-Intelligence-featured.jpg) BLOG

### AI

**Weaponized Intelligence**

We are building the foundation that makes defense possible....

[Nikesh Arora](https://www.paloaltonetworks.com.au/perspectives/author/nikesh-arora/ "Posts by Nikesh Arora")
[](https://www.paloaltonetworks.com.au/perspectives/weaponized-intelligence/)  
STAY CONNECTED

## Connect with our team today

Job Level  
Sign me up to receive news, product updates, sales outreach, event information and special offers about Palo Alto Networks and its partners.  
By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown) and [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown).  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.
Reach out  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira?ts=markdown)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management?ts=markdown)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management?ts=markdown)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager?ts=markdown)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance?ts=markdown)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management?ts=markdown)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic?ts=markdown)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management?ts=markdown)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance?ts=markdown)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery?ts=markdown)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)

* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)

* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)

* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)

* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)

* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* AU  
  Select your language