Strengthening Your Cybersecurity Assessment: Addressing Overlooked Vulnerabilities

By Hannah Barrier , Senior Associate

In an era where digital threats are evolving at a rapid pace, ensuring robust cybersecurity is more critical than ever. As Jim Langevin, a former U.S. Congressman and leading advocate for cybersecurity, wisely said, “Effective cybersecurity is not a product, but a process.” Yet, while companies invest heavily in protecting their IT infrastructure, certain areas of cybersecurity often go overlooked, leaving significant vulnerabilities. This challenge is evident across supply chains, where systems connected to third-party vendors for operational efficiency can become vulnerable if those vendors fail to maintain strong cybersecurity practices.

Alarmingly, only 23% of companies report that their cybersecurity metrics are well understood by the board and senior executives, highlighting a disconnect that can leave organizations exposed. The focus is on three key, often overlooked areas: governance and data privacy, supply chain security, and the emerging risks tied to AI and Machine Learning (AI/ML). By addressing these vulnerabilities, organizations can strengthen their defenses and protect their systems from increasingly sophisticated cyber threats.

Cybersecurity Governance in Strengthening Data Privacy and Security Practices

Governance isn’t just about compliance; it’s an ongoing process that protects sensitive information and digital assets. In today’s cybersecurity landscape, it’s the foundation for managing digital resources and safeguarding critical data.

Unfortunately, many companies treat governance as a one-time task, neglecting regular updates and risk assessments. This oversight leaves critical gaps, especially in industries like healthcare, finance, manufacturing, and retail, where operational and sensitive data are prime targets for cybercriminals.

At its core, governance ensures a structured approach to managing security risks, with clear roles and responsibilities, comprehensive data protection policies, and regular updates to address new threats.

A vital practice within governance is conducting regular risk assessments. These assessments help companies identify and prioritize vulnerabilities in their IT systems before they can be exploited. For example, a global enterprise managing vast amounts of operational data, such as customer records or production metrics, risks leaving critical information exposed if routine risk assessments are not performed. Without them, outdated software or poorly secured access points could go unnoticed, increasing the chance of a breach. One of the main challenges companies face is accurately identifying key risks; in fact, 31% of executives report that improper identification of risks is their biggest cybersecurity hurdle.

Supply Chain Security

In terms of Supply Chain security, only 23% of security leaders actively monitor their partners and vendors in real time for cybersecurity risks. Relying solely on periodic risk assessments is no longer sufficient. Continuous monitoring has become essential, especially in supply chain operations where vulnerabilities are widespread. Too often, businesses focus primarily on internal systems, neglecting the significant risks posed by external vendors.

To truly protect against these evolving threats, companies need to consider how they are accessing vendor risk, managing what vendors have access to and clear communication on security approach with vendors.

Rethinking Vendor Risk Management - The traditional approach to vendor risk management—questionnaires, compliance audits, and occasional assessments—is no longer enough. These processes often provide only a snapshot in time, leaving gaps as the threat landscape evolves and vendors update their systems. Once an audit is complete, the information can quickly become outdated, making this approach insufficient in identifying emerging risks.

What’s needed is a more dynamic, continuous method for monitoring third-party security. This includes utilizing risk management platforms that provide real-time insights into vendor vulnerabilities, integrating threat intelligence, and routinely conducting penetration tests. By staying updated on potential risks, organizations can better protect themselves from evolving threats.

Managing Vendor Access - Another key aspect of supply chain security is controlling how much access vendors have to internal systems. Traditionally, vendors have been granted broad access, which increases the potential for a single compromised account to open the door to a larger breach. A more effective strategy is adopting a zero-trust approach, where vendors only have the minimum level of access necessary, and that access is constantly reevaluated. Using tools like role-based access controls (RBAC) and implementing just-in-time (JIT) access ensures that vendors only have the permissions they need, and only when they need them.

Building a Collaborative Approach - Strengthening supply chain security also requires collaboration. It’s important to work closely with vendors to ensure everyone is aligned on security expectations. This can include sharing security scorecards, providing regular updates on vendor security posture, and offering training to help them stay ahead of emerging threats.

Ultimately, securing your supply chain isn’t just about safeguarding external partners—it’s about protecting your entire business ecosystem. Continuous, proactive risk management is essential for staying ahead in a rapidly changing cyber threat landscape. By evolving beyond static vendor assessments and embracing an ongoing, collaborative approach, organizations can build more resilient supply chains and better protect their critical assets.

Safeguarding AI & Machine Learning Systems

AI and Machine Learning (ML) systems are being rapidly integrated across sectors like healthcare, finance, manufacturing, supply chain, autonomous vehicles, and social media. As these technologies advance, cyber attackers are finding new ways to exploit their vulnerabilities. A growing focus in cybersecurity has been on safeguarding AI and ML systems, as these platforms are increasingly becoming targets for sophisticated threats. These threats can include data poisoning and AI system manipulation

Data poisoning occurs when an attacker deliberately corrupts the training data used by AI or ML models. The goal is to manipulate or weaken the model’s performance or introduce security gaps for future exploitation. These attacks can cause AI systems to make inaccurate decisions, introduce bias, or even fail entirely. With the average time to detect a data breach being 118 days, these threats can linger unnoticed for extended periods, compounding the damage.

AI system manipulation is the intentional exploitation or interference with an AI system's input, environment, or operation to cause it to make incorrect or harmful decisions. The manipulation can be done by altering the data or signals the AI processes in real-time to influence its behavior.

A great example of this is from 2017 when researchers at CleverHans Lab and other institutions demonstrated how small, seemingly insignificant changes to road signs could deceive the AI systems in self-driving cars. They applied carefully crafted stickers to a stop sign, which to the human eye looked normal, but these minor alterations tricked the AI system into misclassifying the stop sign as a yield or speed limit sign.

Securing AI and Machine Learning (ML) systems from data poisoning and AI system manipulation requires implementing a combination of strategies and best practices throughout the AI lifecycle. Organizations should implement adversarial training, data validation and sanitization, model monitoring, access encryption, and various other security measures.

Building a Strong Cybersecurity Foundation: Key Takeaways for Businesses

In today’s rapidly changing threat landscape, businesses must go beyond surface-level cybersecurity measures to address often-overlooked areas. Failing to adapt to these evolving risks can leave critical systems exposed, resulting in severe operational and financial consequences. By 2025, it is estimated that 60% of organizations will consider cybersecurity risk as a key factor in determining transactions and business engagements with third parties, emphasizing the growing importance of a robust cybersecurity strategy.

Organizations across all sectors can enhance their security posture by implementing continuous monitoring, regularly assessing risks, and collaborating with third-party vendors to ensure strong cybersecurity practices. The increasing reliance on AI and machine learning, along with the complexity of modern supply chains, demands a proactive approach. By recognizing and mitigating these risks, companies can safeguard their data, maintain customer trust, and build a more resilient and secure business ecosystem.