Why IoT in Your Supply Chain Still Poses a Serious Cyber Risk

Audio Recap

IoT security risk

In today’s digital economy, every organization—whether a law firm, retailer, or financial services provider—is now part of someone’s critical infrastructure. A dangerous misconception persists: that Internet of Things (IoT) devices and Industrial Control Systems (ICS) are only concerns for industrial or manufacturing sectors. In reality, these technologies are quietly embedded in everyday operations across nearly every industry. From smart HVAC systems to networked printers and logistics software, IoT and ICS have become integral parts of extended supply chains.

This deep interconnectivity introduces significant risk. Cybercriminals increasingly exploit the trust placed in third-party vendors, cloud platforms, and open-source tools. Attacks that compromise a single supplier can ripple throughout a network, affecting countless downstream partners. The SolarWinds breach is a prime example: malicious code inserted into a trusted software update led to widespread compromise across public and private sectors.

The hidden risk in modern supply chains

A growing concern in this landscape is the "silent supply chain": the network of third- and fourth-party services that organizations may not even realize they are connected to. These overlooked partners can include HVAC systems, IoT-connected smart devices, or niche platforms with weak security postures. With minimal oversight and limited cyber maturity, these silent links often introduce unseen vulnerabilities into otherwise secure environments.

Shadow IT, open ports, and unmanaged IoT devices further expand this hidden risk. For instance, in one 2019 case, a threat actor gained access to a solar energy firm through a poorly secured third-party connection, remaining undetected for an extended period. The reality is that attackers are not just targeting your suppliers, they may be targeting you through them.

This is where Bitsight Cyber Threat Intelligence (CTI) offers a crucial advantage. By continuously monitoring your organization’s extended digital footprint, including the hidden layers of your supply chain, Bitsight identifies exposures and third-party risks before attackers can exploit them. With actionable intelligence, you can proactively defend your organization and reduce risk across your entire ecosystem.

IoT devices expand your attack surface

IoT and ICS technologies introduce vulnerabilities that make them prime targets for attackers. These devices often run on outdated software and lack even the most basic safeguards such as encryption, patching, or authentication. Designed for longevity and uptime rather than security, they are ill-equipped to handle the tactics used by today’s threat actors.

Bitsight TRACE research has shown that this risk is not theoretical. In The Unforgivable Exposure of ICS/OT, we revealed how critical systems that power our world are being connected directly to the internet with little to no protection. Power grids, pipelines, water plants, and manufacturing systems are frequently left exposed, often using default credentials, outdated software, or no segmentation. Even new deployments are being placed online without secure configurations. That, coupled with the finding that we’re on pace to cross 200,000 exposed ICS/OT devices before the end of 2025, is cause for concern.

The danger lies in what these systems control. ICS and OT devices manage physical processes that keep society running: regulating gas flow, water pressure, temperature, and energy distribution. When these systems are compromised, the consequences move beyond digital disruption to real-world harm. In 2021, for example, attackers attempted to poison a Florida water plant, which could have resulted in catastrophic outcomes. The stakes could not be higher.

The problem is compounded by the lack of visibility into third- and fourth-party environments. Most organizations cannot map their full supply chain or identify every connected device. A single misconfigured or unpatched sensor within a vendor’s network can provide an attacker with the access needed to move laterally and cause significant damage.

This attack surface is constantly changing as organizations adopt new technologies, integrate new services, and build new partnerships. Threat actors take advantage of this growing complexity by using remote access trojans (RATs), malware-as-a-service (MaaS), phishing, backdoors, and shadow IT to infiltrate and remain undetected.

Even if internal controls are strong, exposure extends across the entire ecosystem. One insecure IoT sensor or neglected ICS controller within a supplier’s environment can have serious consequences. Bitsight CTI continuously monitors these layers to identify vulnerable assets, providing the visibility and insight organizations need to act before attackers do.

Why traditional risk assessments fall short

Traditional risk assessments often fail to capture the depth and complexity of today’s digital supply chains. While they may focus on direct vendors and known risks, they rarely account for the presence of IoT and ICS within third- and fourth-party ecosystems.

A key challenge is attribution. Vendors have their own vendors, each introducing their own devices and software. Without clear visibility, it is nearly impossible to assess where risk is coming from or how it might impact your environment. These blind spots can leave your organization vulnerable to threats you cannot see.

Employee behavior also introduces risk. Rogue IoT devices, such as a Bluetooth speaker or smart plug, can connect to corporate networks without going through IT oversight. These unapproved devices increase the attack surface and often go undetected.

Bitsight CTI addresses these challenges by continuously mapping and monitoring extended vendor ecosystems. It helps organizations discover hidden IoT and ICS connections, assess their risk level, and prioritize remediation.

Your ecosystem is your exposure

In today’s interconnected world, the security of your organization is inseparable from the security of your supply chain. Even if your internal defenses are mature, the risk introduced by your partners’ devices, networks, and practices can expose your business to severe consequences.

This risk is not theoretical. A single unpatched CVE or unprotected device in a supplier’s network can cause widespread disruption, financial loss, and reputational damage. The responsibility no longer stops at your firewall, it now includes every organization you are connected to, whether directly or indirectly.

Bitsight CTI enables organizations to understand and monitor these digital dependencies. It reveals risks in places you may not even know exist, contextualizes threats, and helps you make informed decisions about which exposures require urgent attention.

How Bitsight CTI helps

• Visibility: Identify indirect connections through deep third- and fourth-party mapping
• Attribution: Uncover hard-to-trace infrastructures and identify hidden IoT and ICS risks
• Context: Understand which vulnerabilities matter most with contextualized insights
• Prioritization: Focus efforts on the exposures that pose the greatest threat to your organization

Talk to our team to see how Bitsight can help you uncover and act on hidden risks before attackers do.