Don't be the last to know: Threat intelligence for supply chain defence

How many of you have learned about a vendor breach from the news — before the vendor told you?

It happens more often than it should. And when it does, the real problem isn't the delay in communication. It's a visibility gap. The earliest signals of a supply chain compromise rarely appear inside your environment — or even inside your vendor's. They surface in credential dumps, attacker forums, dark web chatter, and infrastructure scan patterns. By the time it becomes a headline, the attacker already has a head start.

This session is about making sure you're never the last to know.

Third-party breaches nearly doubled in 2025, averaging 26 significant incidents per month, with roughly 70% of organisations experiencing at least one. And the organisations hit weren't weak — many had strong internal controls. The breach started somewhere else: in their supply chain.

Through two real-world attack stories — one devastatingly human, one technically invisible — this talk unpacks how modern supply chain attacks actually unfold. We explore the core pattern behind nearly every major incident: identity compromise, integration abuse, and ecosystem-wide explosion. We examine why Tier 1 assessments give a false sense of security, and why the real risk often lives in the shared dependencies connecting Tier 2 and Tier 3 suppliers.

The second half of the session is practical and actionable. Attendees will walk away with a three-layer threat intelligence model — covering credential exposure signals, targeting pressure indicators, and technology exploitation patterns — mapped to a concrete operational workflow: Watch, Prioritise, Act.

We also cover how to build meaningful supply chain threat intelligence using free and low-cost tools, including Have I Been Pwned, Shodan, CISA KEV, dnstwist, and OpenCTI — making this relevant for teams at every budget level.

This isn't a theoretical framework. It's a field-tested approach to detecting supply chain risk before it becomes your incident.