Author: Ami DePierro | Co-Founder, 2 Dog Digital
Ami DePierro is Co-Founder of 2 Dog Digital and a former US Marine Intelligence Analyst who brings analytical precision to cybersecurity strategy for small and mid-sized businesses across the Raleigh/Triangle area. Digit is the voice. Ami is the author.
I’ve spent enough years barking orders to know something important about security: trouble does not always come charging through the front gate. Sometimes it walks right in behind someone you already trust.
Business owners spend a lot of time worrying about hackers attacking them directly. They picture someone sitting somewhere trying to break into their network one password at a time.
Sometimes that happens.
But attackers are pretty good at finding an easier path. If your systems are locked down, they start looking at who else has access. Your IT vendor may need access to keep things running. Your payroll company connects to important business information. The software your team uses every day may have permissions you never think about.
That trusted access is exactly what makes a supply chain attack so effective.
The attacker compromises a company you already rely on, then uses that relationship to move closer to your business. Kind of like a squirrel realizing the fence is secure, so he waits for someone else to open the gate.
I respect the planning.
That squirrel is still staying on the other side of my fence.
What Is a Supply Chain Attack, and Why Should You Care?
A supply chain attack happens when an attacker compromises a third party connected to your business. That could be a vendor, contractor, software provider, or another outside organization with access to your systems.
Instead of spending all their energy trying to break into your company directly, attackers look for another way in.
Because sometimes the weakest part of your cybersecurity is not on your own network.
It is someone else’s unlocked gate.
Digit’s Rule #7: A vendor who dodges a direct security question has already answered it.
You would not hand out keys to your building without knowing who had them. Your technology deserves the same attention.
The 2020 SolarWinds attack is the example cybersecurity teams still talk about because it showed how much damage a supply chain attack can cause.
Attackers placed malicious code inside a routine software update from a trusted IT management vendor. Businesses and government agencies installed the update because it came from a company they already knew.
The attackers did not have to break into every organization individually. They found one trusted pathway and used it.
That is why supply chain attacks continue to be a serious cybersecurity risk for small businesses.
When attackers find something that works, they usually keep doing it.
And if there is one thing an old Marine knows, it is that you pay attention when the other side finds a working strategy.
How Do Supply Chain Attacks Actually Work?
Here are the mechanics, stripped down.
An attacker breaches Vendor A. Maybe someone clicked a phishing email. Maybe an old password was stolen. Maybe a system went too long without being patched.
Now Vendor A has a problem.
Your business has a bigger one.
That vendor may already have trusted access into your systems because you gave it to them for a legitimate reason. A software provider needs to push updates. Your IT vendor needs secure access to support your team. Other business tools may connect behind the scenes so your company can operate.
The attacker does not have to fight through every layer of your cybersecurity if they can walk through a door that was already opened for someone else.
Your systems were designed to trust that vendor.
The attacker is counting on that.
Digit’s Rule #16: Every new piece of software is a new door. Know where your doors are.
One successful vendor breach can give cybercriminals a path toward dozens, or even hundreds, of other businesses connected to that company.
Attackers understand efficiency. They look for the route that gets them the most access with the least resistance.
I spent years teaching Marines that the smartest approach is not always the loudest one. Sometimes the biggest advantage comes from finding the path nobody is watching.
Cybercriminals figured that out too.
Why Hackers Target Vendors Instead of You
Business owners ask this a lot: why would an attacker go through someone else instead of coming directly after my company?
Because attackers look for opportunity.
A vendor with access to multiple businesses can be a much bigger target. If a cybercriminal compromises the right software provider or technology partner, they may get a path into many companies at once.
Breach one house, and you get one house.
Find the person carrying keys to the whole neighborhood, and now you have my attention.
Supply chain attacks also create something attackers love: confusion.
When a breach starts with a vendor, everyone has to figure out what happened. Which systems were affected? What data was exposed? Who had access?
While businesses are sorting through those answers, attackers may already be moving deeper into systems, stealing information, or preparing for their next step.
A little confusion can create a lot of opportunity for someone who knows how to use it.
Why Small Businesses Are Bigger Targets Than They Think
A lot of small businesses assume they are too small to be worth an attacker’s time.
Attackers are counting on that assumption.
Small businesses are often connected to bigger systems, larger companies, and vendors with access across many organizations. Sometimes the easiest way into a bigger target starts with finding a smaller door.
And attackers like smaller doors.
If a vendor has access to your systems, customer data, or network, their security decisions can affect your business. When that vendor gets compromised, you may be dealing with the consequences even though the attack started somewhere else.
Your customers are not going to spend much time studying the technical path the attacker took. They want to know what happened to the information they trusted you to protect.
I have seen plenty of businesses treat vendor relationships like a handshake and a signature.
That is a lot of faith to put in someone else’s security plan.
I did not trust every Marine who showed up in a clean uniform and polished boots just because they looked squared away.
A good uniform told me they knew how to look prepared.
The rest came from asking questions, checking the details, and seeing how they operated when things got difficult.
Your vendors should be able to do the same. They should be able to explain how they protect their systems because their systems may have access to yours.
What You Can Actually Do About Vendor Risk
None of this means you need to fire every vendor and start doing everything yourself.
That sounds exhausting.
Dottie would probably remind me that most business owners already have enough to do, and for once, I would have to admit she has a point.
The goal is not avoiding vendors. The goal is knowing who has access to your business and making sure that access makes sense.
- Ask better security questions. “Are you secure?” is going to get you the same answer every time. Nobody is going to look you in the eye and say, “Not really, but thanks for asking.” Ask about things you can actually verify, like multi-factor authentication, security processes, and what happens if there is an incident.
- Review who has access and why they have it. A vendor should have the permissions they need to do their job. Nothing more. Giving everyone full access because it is easier creates exactly the kind of opening attackers look for.
- Pay attention after the contract is signed. Companies change. Employees leave. Software changes ownership. The vendor you approved two years ago may not look exactly the same today.
- Have a plan for vendor-related security incidents. Your incident response plan should include what happens if the problem starts outside your company. Know who you contact, what needs to be reviewed, and what steps happen next.
Vendor risk management is not about assuming everyone is doing something wrong.
It is about confirming the right things are being done.
I did not invent “trust but verify,” but after enough years in uniform and enough years watching technology problems unfold, I can tell you there is a reason that phrase stuck around.
Where a Firewall Fit - and Where It Doesn't
A firewall is important.
Before anyone tells Dottie I said otherwise and gets me in trouble, let me be clear. A firewall is one of the tools that helps protect your network by controlling traffic coming in and going out based on security rules.
But even a good fence has limits.
A firewall cannot interview your vendors. It cannot check their security practices. It cannot magically know that a trusted login is now being used by someone who should not have it.
If an attacker gets through a door your business intentionally opened, you need more than a locked fence around the yard.
Firewalls are part of a strong cybersecurity plan. Knowing what they do, and what they do not do, is how you avoid leaving gaps attackers can use.
That is where vendor risk management and the right managed IT partner come in.
If you are running a business in Raleigh or anywhere in North Carolina and you are not sure who has access to your systems right now, that is worth figuring out before there is a problem.
A managed IT provider can help identify third-party connections, review vendor access, remove permissions that no longer belong there, and make sure a trusted relationship does not quietly become someone else’s way into your business.
Dottie does not let strangers near her food bowl without a proper sniff-and-approve process, and she is a Scottish Terrier, not a security consultant.
Your network deserves at least that much scrutiny for every vendor holding a key to the building.
Stay sharp out there.
And for the love of bacon, ask your vendors the hard questions before someone else gives you a much harder lesson.
At 2 Dog Digital, we help small businesses understand who has access to their systems, close security gaps, and build technology processes that make sense for the way they actually work.
Because good cybersecurity is not just about adding more tools.
It is about knowing what you have, knowing who can access it, and making sure somebody is keeping watch.
FAQ: Small Business Firewall Questions We Actually Hear
What is a supply chain attack in cybersecurity?
A supply chain attack happens when a cybercriminal compromises a vendor, software provider, or other trusted third party and uses that access to reach your systems.
The attacker is taking advantage of a relationship your business already trusts, which is why vendor security matters.
How do supply chain attacks work?
Supply chain attacks usually start when an attacker compromises a third-party vendor through something like phishing, stolen credentials, or an unpatched system.
If that vendor already has trusted access to your network through software, remote support tools, or connected accounts, the attacker may be able to use that same pathway.
How do I know if my vendors are secure?
Ask specific questions.
“Are you secure?” is about as useful as asking a Labrador if he already ate dinner.
You need details. Ask whether they use multi-factor authentication, how they protect data, and what their incident response process looks like if something goes wrong.
Also ask if they have any certifications, like SOC2 or NIST. These are recognized security levels and give you a much better security posture.
Vague answers tell you something too.
Does my small business in Raleigh need to worry about vendor risk?
Yes. Small businesses in Raleigh and across North Carolina should understand vendor risk because attackers look for access and opportunity.
If a vendor connects to your systems, handles your data, or manages important parts of your technology, their cybersecurity practices can affect your business.
Who is responsible if a vendor causes a data breach?
Responsibility after a vendor-related data breach depends on contracts, regulations, and the details of what happened.
But your customers are still going to look to the business they trusted with their information.
That is why reviewing vendor security before there is a problem matters.