Vendor Exposure: How to Know When a Vendor has Been Attacked, Before They Tell You

Third parties now sit behind almost half of all breaches, yet most security teams still learn of a vendor’s attack from the vendor itself, often weeks after the attacker has made it public.

In short

• When a vendor is hit by an extortion attack, the attacker usually announces it publicly well before the vendor issues a statement of its own.
• Questionnaires and security ratings describe how a vendor looks, but neither tells you that it has just been attacked.
• CybelAngel Vendor Exposure matches publicly claimed attacks against the vendors you declare, and sends you a report whenever one of them is named.

Security teams are used to chasing their vendors, whether for a questionnaire that never comes back or over a notification clause that nobody has ever tested. This year the pressure reached a new level. Verizon’s 2026 Data Breach Investigations Report found a third party involved in 48% of breaches, a share that has risen from 15% to 30% and now 48% across its last three editions.

Regulators have drawn their own conclusions. In November, Europe’s financial supervisors placed 19 technology providers under direct oversight under DORA, although the banks and insurers that rely on those providers remain just as responsible for managing the risk. ENISA’s 2025 Threat Landscape, meanwhile, warns that attackers are deliberately targeting the critical dependency points of the digital supply chain, where a single intrusion travels furthest.

That raises a question every CISO should be able to answer without hesitation: if one of your vendors was attacked last night, who would be the first to tell you?

In most cases it would be the attacker. Extortion groups publish the names of their victims precisely to put pressure on them. The vendor’s own statement follows on a timetable set by its lawyers and communications team, sometimes several weeks later. That gap is where vendor exposure turns into lost response time, and it is the gap CybelAngel Vendor Exposure was built to close.

Why do security teams hear about a vendor breach last?

The vendor speaks when it is ready, and its customers depend on it for the news. Before it says anything, it has to establish what happened, consult its lawyers and agree on a message, and it has few reasons to hurry. Ransomware, the type of attack most likely to end in a public claim, now features in 48% of breaches according to the same Verizon report, so this is hardly an edge case.

In the meantime, the customer learns of the incident through an email, a press article or, worse, a question from its own clients that nobody can yet answer. Every day lost in that interval could have been spent rotating shared credentials, suspending an integration or preparing a notification of its own.

Why does the attacker’s claim come before the vendor’s statement?

Publicity is part of the extortion. A name posted on a leak site or a messaging channel gives the attacker leverage over the victim and over the customers and partners who read it. Claims are therefore designed to be seen, which is why they are usually the earliest public sign of an attack.

The same logic calls for caution. A claim is an assertion rather than a confirmed breach: attackers exaggerate, recycle old data and occasionally name the wrong company. It should open a conversation with the vendor rather than close an investigation.

The more practical obstacle is volume. Over the past twelve months CybelAngel recorded more than 62,000 publicly claimed attacks, or roughly 5,000 a month. No security team has the hours to read that list each morning and check it against its vendor register, so in practice nobody does.

What can ratings and questionnaires not tell you about vendor exposure?

Neither can tell you that a particular vendor was attacked last night. Questionnaires and audits capture what a vendor declares about itself at a given moment. Security ratings estimate how robust a vendor appears from the outside, and are refreshed periodically.

Both have their place in selecting vendors and reviewing them. The difference is that a rating describes a likelihood, whereas a claim reports an event: the first helps you decide whom to work with, and the second tells you when to act. Managing vendor exposure requires both, and CybelAngel Vendor Exposure is designed for the second task. It sits alongside whatever third-party risk platform you already run.

What do DORA and NIS2 expect you to know about your vendors?

Both regulations expect organizations to manage the risk their suppliers introduce continuously, rather than once a year. NIS2 lists supply chain security among the risk management measures it requires of essential and important entities. DORA goes further for the financial sector: firms remain fully responsible for the risk created by their ICT providers, and must keep a register of those arrangements.

Sooner or later a regulator, an auditor or a board will put the question directly: when one of your critical vendors was attacked, when did you know, and what did you do? A dated report linked to the original claim is a far better answer than admitting the news arrived through the press.

Know the moment one of your vendors is named. Our team can walk you through Vendor Exposure and help you build your first list of critical vendors.

How does CybelAngel Vendor Exposure work?

Vendor Exposure is a CybelAngel capability that alerts organizations when an attack is publicly claimed against one of the vendors they depend on.

It starts with a list that you control. Each vendor is declared with its main domain and attached to the relevant subsidiary or workspace. The domain sets the scope: a vendor’s primary domain covers the whole company, while a subdomain narrows monitoring to a single product. Nothing needs to be installed, and the vendor is not asked to fill in anything.

From then on, every publicly claimed attack that names a victim’s website is checked continuously against your declared domains, subdomains included. Matching runs on the domain rather than the company name, which keeps unrelated businesses with similar names out of the results.

When a claim names one of your vendors, a report is delivered automatically, without waiting for an analyst review or for the vendor’s own statement. It identifies the threat actor, links to the original claim and covers four categories of attack: ransomware, data breach, DDoS and defacement. It behaves like every other CybelAngel report, with the same severity scale, the same workflow and the same API access.

What does Vendor Exposure not do?

Monitoring looks forward. It covers claims published after a vendor has been activated, and does not replay earlier ones.

It reports claims rather than investigating them. If you need to go further, CybelAngel analysts can provide a profile of the group behind an attack, an analysis of the published data, a due diligence on the vendor or support during a crisis. These are offered as professional services, separately from the capability.

It also starts with direct vendors. Claimed attacks are the first signal CybelAngel connects to your vendor list, and we intend to bring more of our detection to that same list over time.

よくある質問

Your vendors will not always call first. Tell us which vendors you depend on, and we will show you how Vendor Exposure would watch over them.