As supply chain attacks targeting companies worldwide become more frequent, businesses are shifting their strategies to extend their security boundaries to include their partners. Analysis suggests that the view of partner companies is spreading from mere external suppliers to partners who share responsibility for the security system.

Kaspersky released its 'Supply Chain Security Investment Analysis Report' on the 25th and stated that more than 69% of companies are willing to invest in the security of partners and suppliers to strengthen cyber resilience.

It was found that 25% of companies are already sharing security costs with their partners.

This study was conducted on 1,714 technology experts from companies with more than 500 employees in 16 countries.

Investment intention was highest in India (83%), Indonesia (80%), Russia (80%), and Brazil (76%).

The actual cost-sharing ratios exceeded the average in Hong Kong and Taiwan (33%), Spain (33%), Turkey (31%), and Vietnam (31%).

The background of the report is that over the past year, supply chain attacks compromised about one in three companies, and trust relationship attacks affected a quarter of all companies.

Kaspersky explained that, accordingly, the perception is spreading that the security level of partners with access to the company's infrastructure is directly linked to the company's cyber risks.

“Today, enterprises recognize that security should not end at the internal boundary of the organization but must extend to the entire ecosystem,” said Sergey Soldatov, Head of Security Operations Center (SOC) at Kaspersky. “By sharing resources and expertise, large enterprises can become a key driver in strengthening vulnerabilities and enhancing global cyber resilience.”

Kaspersky identifies the security measures that companies must implement to mitigate supply chain risks as: strengthening security cooperation with suppliers, conducting thorough security level assessments before signing contracts, and regarding software and cloud services.It proposed performing vulnerability and penetration tests, specifying regular security audits and incident notification protocols in the contract, and applying the principle of least privilege, Zero Trust, and identity management systems.

Lee Hyo-eun, General Manager of Kaspersky Korea, stated, “With the increasing number of sophisticated supply chain attacks targeting Korean industries, third-party partners and collaborators are now the key links in the security ecosystem,” adding, “Only by responding as a single integrated ecosystem can we protect Korea’s digital infrastructure from evolving cyber threats.”