A cybersecurity incident does not always begin with the organization holding the largest contract, the biggest security budget, or the most sophisticated defenses. Sometimes, it begins several tiers down the supply chain.
Scott Alldridge, Founder, President & CEO of IP Services and Co-Founder & President of IT Process Institute (ITPI), approaches the issue from the perspective of a managed security provider, where understanding how organizations, systems and third parties connect is central to managing risk.
“I’m a one-to-many,” he says, explaining that an MSP can have access to multiple client environments, including systems, credentials and administrative capabilities. “If I’ve got Bob’s Lug Nuts and Joe’s Lug Nuts and Karen’s Lug Nuts, and I’ve got access to all their systems, all their passwords, all their administrative capabilities, that’s the one-to-many. That’s why third-party risk really matters.”
Invert that relationship and it describes defense manufacturing just as well: a prime contractor can maintain strong cybersecurity controls of its own and still be exposed, because it only takes one supplier, among dozens or hundreds, whose security is weaker than its own. Suppliers, subcontractors, and technology providers can create additional pathways into sensitive systems and information.
The threat is not theoretical. Manufacturing was the most targeted industry for cyberattacks in 2025, accounting for 27.7% of incidents tracked by IBM X-Force and marking the fifth consecutive year the sector held that distinction, according to data reported by Manufacturing Dive.
Ransomware attacks on manufacturers rose 56% year-over-year in 2025, from 937 confirmed incidents to 1,466, and the average ransom demand made of a manufacturer more than doubled, to $1.16 million, according to tracking data reported by Industrial Cyber. A subcontractor three tiers down the supply chain isn’t just an easier target than the prime. It’s now a more lucrative one, too.
CMMC Makes the Supply Chain Part of the Security Conversation
For defense manufacturers, supply-chain cybersecurity is also tied directly to compliance.
Under the Cybersecurity Maturity Model Certification (CMMC) framework and related contractual requirements, cybersecurity obligations can flow from prime contractors to subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).
That creates a practical challenge: understanding what the contract requires is one thing; understanding how sensitive information actually moves between organizations is another. A prime contractor may need confidence that its suppliers are meeting the appropriate requirements, while its own assessment does not necessarily provide visibility into every system, vendor, or subcontractor involved in the flow of information.
For example, a manufacturer may know which systems it controls while having less certainty about whether a supplier is storing CUI on an unmanaged system, sharing technical information through an unapproved platform, or granting access to another third party.
That gap is not hypothetical. In December 2025, the Department of Justice reached its first-ever cybersecurity False Claims Act settlement against a subcontractor rather than a prime. Swiss Automation Inc., an Illinois-based precision-machining supplier, agreed to pay $421,234 over allegations it failed to adequately protect the technical drawings of parts it supplied to DoD prime contractors, in violation of DFARS cybersecurity safeguarding rules, a case triggered by a whistleblower complaint from the company’s own former quality control manager. Every cybersecurity False Claims Act settlement DOJ had closed before that one involved a prime or a direct contractor. This one reached two tiers down.
For Scott Alldridge, this distinction is important because compliance within one organization does not automatically eliminate risk elsewhere in the chain. A security program can satisfy a specific requirement while still leaving gaps in how information and access are managed across connected organizations.
The New Supply-Chain Question: What About AI?
Technology is creating another version of the same challenge.
Manufacturers are increasingly introducing artificial intelligence into operations, including tools used for document analysis, quality control, predictive maintenance and workflow automation. These systems can improve efficiency, but they can also introduce new questions about how information is handled.
A manufacturer may know that an AI tool is being used on the production floor without fully understanding what information the tool can access, where that information is processed, or whether sensitive files are being incorporated into the system.
For organizations handling CUI, those questions are particularly important.
The issue is not whether AI is inherently insecure. It is whether emerging technologies are being evaluated with the same discipline applied to traditional vendors and IT systems.
An AI application with access to sensitive engineering documents can represent a data-governance concern in much the same way an inadequately assessed supplier can.
Alldridge’s perspective points to a broader principle: the technology itself may not be the central issue; the challenge is whether organizations understand and govern the access that technology creates. In both cases, the underlying question is similar: has access expanded faster than the organization’s ability to verify and manage it?
Looking Beyond the Front Door
This is where third-party risk management becomes more than a compliance exercise.
Organizations need to understand not only which suppliers they use, but what role those suppliers play in handling sensitive information, how credentials are managed, where information is stored, and what happens when a relationship changes.
That can require going beyond questionnaires and contractual assurances.
For manufacturers operating within the defense ecosystem, a useful starting point is to map the flow of CUI and other sensitive information across the organization and its suppliers. From there, security teams can identify which external parties have access, determine which relationships represent the greatest potential impact, and prioritize deeper reviews where necessary.
From a managed security perspective, this means treating supplier relationships as part of the broader attack surface rather than as a separate administrative concern. The objective is not to assume every vendor represents a threat, but to understand which relationships create meaningful exposure and whether the safeguards around them are appropriate.
That distinction is increasingly relevant as manufacturers face overlapping pressures from cyberattacks, contractual requirements, insurance expectations and new technology adoption.
For Alldridge, the goal is not to treat every supplier as a potential point of failure, but to identify where trust has been extended and whether the controls surrounding that trust are proportionate to the access being provided.
The Weakest Link Isn’t Always Where You Think
The question for manufacturers, then, is not simply whether their own systems are secure.
It is whether their security strategy accounts for the organizations, technologies and relationships their systems depend on.
For a defense manufacturer, that may mean looking beyond the prime contract, beyond the primary network and increasingly beyond traditional IT. Suppliers, software platforms and AI tools can all become part of the organization’s effective security boundary.
The organizations best positioned to manage that risk may not be the ones that eliminate every vulnerability. They may be the ones that understand where trust has been extended, identify which relationships matter most, and verify that the controls surrounding those relationships are proportionate to the access being provided.
