Supply Chain Attacks in 2025: How PTaaS Helps Test and Mitigate Third-party Risks

Summary

• Supply chain attacks compromise a trusted vendor or provider to reach many downstream customers at once (e.g., SolarWinds via a tainted software update).
• Impact can be widespread: SolarWinds affected 18,000+ organizations and caused major financial and data-security fallout.
• Third-party incidents are rising: 70%+ of organizations reported at least one such incident in 2025 (Security Scorecard); and large third-party compromises are up ~4x since 2020 (IBM).
• Despite concern, fewer than half of organizations actively monitor supply chain risk, creating a visibility gap.
• PTaaS helps by continuously testing third-party or open-source components with automation and human experts, centralizing findings, and enabling faster remediation.

Key Terms:

Supply Chain Attack: A supply chain attack is a strategic cyberattack where threat actors compromise a trusted supplier, such as a software vendor, service provider, or open-source dependency, to deliver malicious code or gain access that spreads to the supplier’s downstream customers.

Why PTaaS Matters for Supply Chain Security

Mention “supply chain attack” and the SolarWinds breach of 2020 comes to mind almost immediately. In this attack, a group of threat actors inserted malicious code into SolarWinds’ Orion IT management software. SolarWinds customers trustingly downloaded these updates, unknowingly installing a backdoor that allowed the criminals to compromise the victims’ networks and even spy on additional organizations.

The SolarWinds incident perfectly illustrates the potential damage that a single supply chain attack can cause.

This one compromise affected over 18,000 businesses worldwide, as well as several government agencies in the United States and elsewhere.¹ It allowed the attackers to gain stealthy access to the sensitive networks and data of these victims. Moreover, it had a significant financial impact on the organizations, costing them 11% of their annual revenue on average.²

The SolarWinds attack is by no means an isolated supply chain attack.

If anything, recent research suggests that third-party cybersecurity incidents have surged in recent years.

In 2025 for example, more than 70% of organizations experienced at least one such incident.³ And according to IBM, “large supply chain or third-party compromises” have increased by nearly 4X between 2020 and 2025.⁴ These stark findings explain why 88% of security leaders are concerned about supply chain cyber risks.³

But despite knowing about these risks in theory, fewer than 50% of organizations monitor their supply chains. This gap reduces their visibility into the risks in practice.³ Lack of visibility is one of the biggest cybersecurity challenges for many firms because it makes it harder to secure the supply chain, which then increases the risk of supply chain attacks.

Penetration Testing as a Service (PTaaS) can help ease these challenges. This modern approach to pentesting combines technology with human expertise to provide comprehensive visibility into the supply chain, and enable continuous, real-time mitigation of supply chain vulnerabilities.

How does PTaaS empower organizations to identify and remediate risks within the supply chain?

This article explores.

Supply Chain Attacks and the Need for Third-party Risk Management

A supply chain attack is a type of sophisticated, well-planned cyberattack in which threat actors compromise a trusted third-party, such as a software vendor, to indirectly breach a large number of the vendor’s customers. In these attacks, the adversaries don’t go after victims directly, and they don’t waste time or effort crafting and executing individual attacks. Instead, they target weaker points of entry along the software supply chain and leverage a single third-party’s distribution pipeline to simultaneously reach and compromise a large number of downstream customers.

Fortunately, organizations can stave off supply chain attacks. But to do so, it is critical to:

• Evaluate and strengthen supply chain cybersecurity
• Understand and mitigate third-party risk

PTaaS is an effective and affordable approach to achieve these goals.

How PTaaS Can Mitigate Third-party Risk and Prevent Supply Chain Attacks

Most supply chain attacks succeed because they exploit the trust relationships between third parties – vendors, manufacturers, service providers, and so on – and their customers. PTaaS provides a means to continuously test whether this trust can be abused and to assess the potential damage that may be caused by such abuse.

PTaaS is a modern, cloud-based, on-demand pentesting approach that provides substantial benefits compared to legacy penetration testing solutions. It strengthens defenses against supply chain threats by providing continuous testing and validation across the entire IT ecosystem, including third-party and open-source:

• Software (on-premises and SaaS)
• Software components
• Code repositories and libraries
• APIs
• Cloud services
• DevOps tools
• Integrations

PTaaS is designed to continuously test and validate all these elements of the supply chain to reduce the likelihood that a compromised supplier would become an organization’s attack entry point. This pentesting model combines automation with human expertise. Automated scans identify common vulnerabilities, while human ethical hackers perform deeper, real-world attack simulations.

Testing from the adversary’s perspective highlights the tactics, techniques, and procedures (TTPs) of real attackers. Continuous, adversary-focused pentesting enables security teams to detect supply chain weaknesses and understand how real adversaries may target and exploit those weaknesses. Defenders can then leverage this understanding to prioritize remediation for critical paths that real attackers actually use.

PTaaS services are delivered through the BreachLock Unified Platform that can map the attack surface and consolidate all test findings in a single, live dashboard. This centralized approach transforms pentesting from a one-off, point-in-time exercise into a continuous engagement that facilitates ongoing vulnerability remediation and security validation for the supply chain.

At the end of the scan, security teams can access deep, contextual insights across the entire supply chain from the platform. These real-time results enable defenders to act immediately on supply chain risks, thus enabling faster exposure reduction and risk mitigation.

Unlike traditional pentesting, PTaaS ensures that the security posture keeps pace with changes to the supply chain infrastructure and the threat landscape. Since testing happens continuously, it surfaces new vulnerabilities in the supply chain even as the environment changes. Security personnel get continual, real-time visibility into the threat landscape, so they can take immediate, proactive action to fix security flaws and safeguard business-critical assets and data from supply chain attacks.

Avoid Supply Chain Attacks in 2026 with BreachLock PTaaS

BreachLock offers continuous, comprehensive, certified pentesting services for modern organizations with complex, at-risk supply chains. With BreachLock, you can quickly multiply both the scale and speed of vulnerability identification and prioritization, thus ensuring continuous protection from supply chain attacks.

Our hybrid (automated + human) PTaaS services are delivered via a unified platform that can identify complex patterns and anomalies faster than manual methods. It can also predict exploitable vulnerabilities to ensure accurate risk identification. Most importantly, it delivers rich, contextual, real-time insights into the most exploitable points of interest by an attacker so you can act promptly to effectively reduce your attack surface.

Safeguard your supply chain from attack with BreachLock PTaaS. Get started today.

References

1. Fortinet. Solar Winds Cyber Attack. https://www.fortinet.com/resources/cyberglossary/solarwinds-cyber-attack

2. IronNet (2021). 2021 Cybersecurity Impact Report. https://www.ironnet.com/hubfs/IronNet-2021-Cybersecurity-Impact-Report-June2021.pdf?hsLang=en&submissionGuid=39c8446a-6789-41e5-8652-a7dd61b8af94

3. Security Scorecard (2025). 2025 Supply Chain Cybersecurity Trends. https://securityscorecard.com/wp-content/uploads/2025/06/2025-Supply-Chain-Cybersecurity-Trends.pdf

4. IBM (February 2026). IBM 2026 X-Force Threat Index. https://newsroom.ibm.com/2026-02-25-ibm-2026-x-force-threat-index-ai-driven-attacks-are-escalating-as-basic-security-gaps-leave-enterprises-exposed

Author



BreachLock Labs