Supply chain risk takes center stage in cyber sovereignty as hidden dependencies, long

Cyber sovereignty is becoming clearer, and for critical infrastructure operators, that clarity could not have come soon enough, ushering in a new era of stronger, more resilient supply chains built on trust and accountability. Typical rules of digital engagement are being rewritten when every third-party vendor relationship is a potential access point and adversaries have demonstrated they are willing to move silently through supply chains for months before conducting an attack. Regulators are increasing scrutiny, boards are raising the bar, and governments are drawing bright lines around trusted vendors, while requiring more transparency in software bills of materials ( SBOMs ).

Supply chain security across critical infrastructure installations can no longer afford to be an afterthought, but is now something that organizations must consider when building resilience planning. What was once treated as a compliance exercise is being reframed as something more fundamental, addressing control, resilience, and strategic autonomy.

There are signs of progress, real ones. Deloitte data shows organizations investing more heavily in securing converged IT and OT environments, a recognition that supply chain exposure can directly derail operational continuity. IDC insights point in the same direction, as spending on supply chain risk management technologies is climbing as firms seek deeper visibility into vendor ecosystems they once took for granted.

But compliance alone isn’t cutting it anymore. Research flagged by the World Economic Forum (WEF) found that more than half of large organizations see supply chain complexity as a core barrier to cyber resilience. The problem isn’t just identifying risk, but is verifying trust across layers of suppliers, many of them operating in geopolitically sensitive regions where loyalties and regulations don’t always align with operational expectations.

That’s where the conversation has shifted. Vendor risk is increasingly viewed through a national security lens, especially across critical environments. Concentration risk, once a procurement headache, now carries geopolitical weight. That’s a different kind of problem entirely.

Governance is moving upward in response. Boardrooms are taking a more active role, pushing for continuous assurance over periodic audits. Closing the remaining gaps will require tighter coordination between governments and industry. This comes with a shared recognition that supply chain security is no longer a side concern. It is central to cyber sovereignty.

Industrial Cyber reached out to industrial cybersecurity experts to examine how cyber sovereignty is defined in the context of critical infrastructure, and how rising geopolitical tensions are forcing industrial organizations to rethink technology sourcing, supply chains, and dependence on vendors.

“Cyber sovereignty, in the industrial context, is an organization’s ability to operate, control and defend its systems without depending on technology that answers to someone else’s government. In industrial operations, this is an operational concern and not just a political issue,” Marco Ayala, technical director for global energy cybersecurity at ABS Consulting, told Industrial Cyber.

“For years, procurement decisions in energy, maritime and chemicals were driven by cost, compatibility and vendor relationships,” Ayala said. “But now, leading industrial organizations are embedding geopolitical exposure criteria directly into vendor qualification processes and technology procurement standards, alongside traditional factors such as functional safety, cybersecurity maturity and interoperability.”

He added that those organizations are asking the right procurement questions: Where is the firmware developed? Who maintains remote access? What are the vendor’s disclosure obligations under their country’s law?

Joseph Saunders, founder and CEO of RunSafe Security , told Industrial Cyber that cyber sovereignty in critical infrastructure comes down to control and assurance.

“Organizations need to know what software they are running on their devices, where it comes from, and whether it can be trusted under pressure,” Saunders said. “As geopolitical tensions rise, there should be a shift from cost-driven sourcing to trust-driven sourcing. Organizations will need to ask harder questions software provenance, because if you can’t verify your software supply chain, you can’t control your risk.”

“For product security teams, this comes down to whether you can patch, trust, and maintain every component in your product when your supply chain crosses jurisdictions. In rail, a sourcing decision locks you into a 25-40 year dependency,” Susan Peterson Sturm, general manager and product line leader KinetiX at Wabtec Corp., told Industrial Cyber. “If that supplier’s government can compel access, withhold updates, or restrict exports, you have material exposure embedded in your product for its entire lifecycle. Quantifying that exposure is where Value at Risk comes in — VaR originated in financial services to express probable financial loss in dollar terms, and the FAIR model adapted it as the international standard for cybersecurity.”

She added that after SolarWinds, the SEC’s 8-K and 10-K disclosure rules made clear that cybersecurity misrepresentation carries securities fraud consequences, with materiality now requiring financial quantification. “Most product security teams don’t yet have the tools to express jurisdictional exposure in those terms, but that’s where we need to get.”

“Data sovereignty dominated governance conversations for the last several years—who owns your data, where it lives, who can access it,” Joshua Marpet, senior product security consultant at Finite State , told Industrial Cyber. “But in critical infrastructure , the question has gotten much more fundamental: Who owns your firmware? Your devices? The NAND chips inside them? Do you actually know where it came from?”

He added that for decades, globalized supply chains enabled cross-border technology adoption, even among geopolitical rivals. “Today, those borders are firming up. Rising geopolitical tension is forcing organizations to reconsider dependencies on foreign vendors, especially in sensitive sectors. Sourcing decisions are increasingly influenced not just by cost and performance, but by trust, transparency, and national alignment.”

The executives point to the biggest blind spots in industrial supply chain risk management and evaluate how organizations are moving past compliance checklists to actually verify whether vendors and components can be trusted.

Ayala said that the biggest blind spot is letting vendors assess themselves. “Without a cold-eyed, third-party review, there’s bias built into the process from the start. You don’t actually know your risk state—not from an objective, risk-based perspective—just what the vendor tells you it is.”

He observed that compliance frameworks help establish a floor. “What mature organizations are doing differently is running objective, third-party assessments that go beyond documentation review. Active verification, for example, includes testing whether segmentation actually holds, whether vendor remote access is actually monitored.”

The biggest blind spots are in the software layers of embedded systems across critical infrastructure, including in third-party components, open-source dependencies, and AI-generated code, Saunders evaluated. “Too many teams still equate compliance with security, but passing an audit doesn’t mean your devices can withstand an attack. Organizations can move toward continuous verification by leveraging Software Bills of Materials ( SBOMs ), real-time vulnerability intelligence, and software hardening to ensure their systems are resilient by design.”

He added, “As we see increasingly sophisticated software supply chain attacks that exploit trust in widely used components, like the recent compromise of the Axios NPM package, it will become important for organizations to have continuous visibility into what’s actually running in their software and to be able to remediate issues swiftly.”

Strum said that vendor due diligence remains document-driven, typically annual surveys, SOC 2, and questionnaires reflecting posture at one point in time. “I can’t wait for the day when suppliers routinely expose real-time SDLC metrics through tooling like GitHub Advanced Security — dependency graphs, SAST/DAST coverage, secret scanning, CVE aging — so we can see into their pipeline and understand where critical vulnerabilities reside as they’re working through them. The tooling exists. Having things outside of real time are not very helpful.”

“There’s a deeper blind spot specific to OEMs across critical infrastructure — rail, medical devices, battery storage,” according to Sturm. “A known vulnerability can’t just be patched in isolation — it may be tied to proprietary protocols or industry-standard architectures requiring coordination across multiple stakeholders and recertification. The real question isn’t whether your supplier has a vulnerability — it’s how quickly they can support you given those dependencies. CRA mandates vulnerability handling but doesn’t account for that reality. That gap is where product VaR lives.”

The biggest blind spot is the ‘black box’ problem of deploying devices without truly understanding what’s inside them, Marpet said. “Unless you crack open the firmware and inspect the components, it’s impossible to validate security claims.”

He added that forward-looking organizations are moving beyond static compliance toward continuous verification. This includes analyzing SBOMs, incorporating Hardware Bills of Materials ( HBOMs ) for provenance, and independently validating vendor claims. The shift is from ‘trust us’ to ‘prove it,’ with continuous monitoring replacing one-time assessments.

The executives review how operators should manage cyber risk in legacy equipment supplied by vendors now seen as geopolitical liabilities. They also address a harder question of when vendor concentration stops being an operational concern and crosses into national security territory.

“Legacy equipment is the hardest conversation/transformation, because ripping and replacing isn’t realistic for most industrial operations. You have to manage the risk around the equipment,” Ayala said. “A practical approach is to first understand what you actually have. Once you have a comprehensive picture, you can build layered defenses around high-risk components (network segmentation, anomaly detection, strict monitoring of any remote access channels and manual override capabilities) that don’t depend on the vendor’s software stack.”

He added that cendor concentration becomes a national security issue when a single foreign vendor controls a significant portion of the control systems across multiple facilities in a critical sector. “When you have that level of concentration, a coordinated action by that vendor’s government, whether through an update, a kill switch or simply withholding support, can cascade across an entire sector simultaneously.”

Saunders said that legacy systems are the reality in industrial environments, and replacing them overnight isn’t feasible. “The focus has to be on reducing risk for devices deployed in the field for decades. Gaining visibility, segmenting critical assets, and applying protections that make software harder to exploit even without source code changes are a few ways to counter geopolitical risks .”

He added that vendor concentration becomes a national security issue when a single supplier’s compromise can ripple across sectors. At that point, it’s not just an operational concern but a systemic risk to resilience.

“We’re seeing this play out in real time with campaigns like Volt Typhoon and more recent activity uncovered in global telecom backbone infrastructure,” according to Saunders. “Adversaries are pre-positioning deep within critical systems using stealthy, long-term persistence techniques. When that level of access exists across widely deployed platforms, vendor concentration becomes a national security concern.”

Sturm analyzes that everyone in this space is operating equipment they can’t fully secure and can’t afford to replace. “The vendor may no longer exist, the source code may be gone, the engineering knowledge may have walked out the door. That’s not a hypothetical — it can happen on any given Taco Tuesday.”

She added that “The question is whether you’ve prepared for the worst case and can quantify what that exposure costs. If a vendor is restricted tomorrow, do you know the dollar cost to maintain service? VaR earns its keep here — not in preventing the legacy problem, which is already here, but in making consequences visible enough to drive capital decisions.”

Marpet said that legacy equipment from vendors in countries of concern presents a difficult tradeoff. Organizations face two options: replace the equipment (often costly and disruptive) or isolate and monitor it to segment the blast radius.

“This operational friction becomes a national security issue when alternatives are limited or nonexistent,” he noted. “If critical infrastructure depends heavily on a narrow set of vendors from a single geopolitical region, and replacing them is not feasible, the risk extends beyond individual organizations to systemic national exposure. If you ban foreign household routers because they relay attacks against critical infrastructure, and people realize no alternative suppliers exist, that dependency itself becomes a definitive national vulnerability.”

The executives assess whether current regulatory frameworks are equipped to address supply chain sovereignty risks and where coordination between government and industry must improve to close the gaps.

“Current regulatory frameworks lack specificity, largely focusing on cybersecurity posture, rather than addressing supply chain sovereignty in a structured way,” Ayala said. “They don’t yet systematically require operators to assess the geopolitical risk profile of their technology vendors or to demonstrate that critical components weren’t sourced from potentially adversarial nations.”

He added that where government and industry need to improve is sharing intelligence. “Agencies know things specific vendors and specific threat vectors that industry doesn’t. The InfraGard model, which connects the FBI with private sector stakeholders, is a useful structure, but it needs to scale faster and become more operationally specific in the OT context. Industry’s own engagement with regulators has to move beyond compliance posture.”

Regulation is moving in the right direction, especially around software supply chain transparency and vulnerability management, but it’s still catching up to the complexity of real-world systems, Saunders said. “The gap is in execution. Industry needs clear, enforceable standards for software transparency and security outcomes, while governments need to work more closely with operators to ensure those standards are practical in embedded and OT environments.”

“CRA provides real leverage for funding. If 30% of your revenue comes from European OEMs, non-compliance is material,” Sturm said. “But product security teams still won’t get fully funded, especially for legacy products in the field. VaR fills that gap — express legacy exposure against revenue at risk, and you have a complete funding argument. Without it, product security competes for capital and loses.”

Recognizing that progress is real, but the pace doesn’t match the threat, Marpet identified that frameworks like CMMC and FedRAMP 20x in the U.S. and ISMAP in Japan are building the architecture for continuous compliance.

“When provenance requirements and Bills of Materials are layered into those frameworks, supply chain sovereignty becomes measurable rather than aspirational,” he added. “The gap is speed and alignment. Regulatory frameworks move on policy timelines; adversaries move on operational ones. Closing that gap requires a tighter feedback loop—industry bringing real-world data on what’s detectable and enforceable, government translating it into requirements specific enough to drive action and updated fast enough to stay relevant.”

The executives analyze who owns supply chain cyber risk within industrial organizations and what mature, board-level governance of that risk looks like in practice.

Supply chain cyber risk, specifically, tends to fall between organizational functions, Ayala said. “Procurement owns vendor relationships. IT owns cybersecurity policy. Operations owns plant uptime. Often, nobody fully owns the question of whether the components running your control systems introduce sovereign or systemic risk.”

He added that in mature governance, supply chain cyber risk is explicitly named in board-level risk disclosures. The Chief Information Security Officer (CISO) or OT security leader has a direct line to the board. Risk tolerance is defined in operational terms: what level of vendor-related cyber exposure is acceptable given criticality, redundancy and recovery capabilities?

“Practically, mature organizations are building 3- to 5-year roadmaps that address supply chain risk alongside broader cyber resilience,” according to Ayala. “Cyber safety, risk and compliance management must span the full lifecycle of a critical asset.

The Board of Directors’ job isn’t to understand every technical detail. It’s to ask the right questions and demand honest answers the organization’s systems, to know who built what and who has access. Leadership must answer those questions confidently to demonstrate mature governance of supply chain cyber risk.”

Likewise, Saunders mentioned that supply chain cyber risk doesn’t sit with one team. “It spans security, engineering, procurement, and operations, and it requires board-level visibility. Mature organizations treat cyber risk as a business risk. That means boards should be asking: Do we know what’s in our software? Can we trust our suppliers? And can we operate if one of them fails? That shift—from compliance to resilience—is what defines strong governance today.”

“Product management — where design decisions, supplier relationships, and lifecycle trade-offs live,” Sturm said. “One of our biggest failures in OT security has been deploying technologies without engaging the operations teams who maintain them. You end up with shelfware. Product managers can design security in and unnecessary labor out, aligning security investments with operational value. VaR gives them the financial language to own that risk at the board level.”

She suggested starting small – downtime estimates, asset-exposure models. CRA makes product security a compliance obligation. VaR turns it into a funded program. Neither works unless the people making product decisions are accountable for the risk.

Marpet said that the instinct is to hand this to the CISO, but CISOs have the most incentive to downplay risk. “Their job depends on appearing in control, which creates a structural conflict for honest board reporting. The CFO has no such conflict. Accustomed to quantifying uncertainty and presenting it plainly, the CFO is better positioned to own the risk conversation, assisted by IT or InfoSec.”

He concluded that mature governance looks like the CFO speaking to the board in dollars versus risks verbiage: what an investment buys down in exposure, what it costs to absorb the risk, and the implications for production uptime and physical safety.