Most organisations assume geopolitical cyber risk is somebody else’s problem. Governments. Defence firms. Energy operators. Critical national infrastructure.
But what about a mid-sized manufacturer, a managed service provider (MSP), a shipping company or a specialist supplier?
Microsoft’s 2025 Digital Defense Report found Russian state actors expanding their targeting towards smaller businesses in countries supporting Ukraine. The researchers suggested these firms may provide easier routes into larger organisations.
CISA and its international partners documented a similar concern in their investigation of Volt Typhoon. Some compromised organisations were relatively small but provided critical services to larger businesses or strategically important locations. The agencies assessed that the attackers were establishing access that could support future disruption of critical infrastructure.
Your organisation may matter because of who you supply, what systems you can access, or who depends on your operations.
And that changes how businesses should assess geopolitical cyber risk.
Key takeaways
- Your business can become involved without being the intended target. Suppliers, service providers and smaller organisations can become pathways into larger, strategically important companies.
- Business relationships shape geopolitical cyber exposure. A new defence contract, privileged customer access or dependence on a critical supplier can change your risk profile.
- A supplier’s cyber incident can become your operational problem. Disruption can spread across manufacturing, logistics, IT systems and other services that depend on third parties.
- Start with access and dependencies. Identify who can access your systems, which customers you can access and which suppliers your operations rely on.
- Test what happens when a critical supplier goes offline. Establish who makes decisions, how access is revoked and whether the business can continue operating during a prolonged disruption.
4 ways your business can become involved
There are four ways an organisation can get caught up in a geopolitical cyber operation:
Target → Pathway → Dependency → Collateral
These categories can overlap, but each reveals a different kind of exposure.
1. Target. An attacker specifically wants your intellectual property, sensitive information, access to infrastructure or the disruption of your operations. Defence manufacturers, research organisations and critical infrastructure operators are obvious examples.
2. Pathway. Your organisation provides access to somebody else. A supplier with administrator credentials for an energy operator, for instance, could give an attacker a route into a much larger environment.
SolarWinds demonstrated what this can look like at scale. In 2020, attackers compromised its Orion software supply chain. Up to approximately 18,000 customers downloaded affected versions, although SolarWinds later estimated that fewer than 100 customers were actually hacked through SUNBURST.
The supplier became the route. The attacker could then select which downstream organisations to pursue.
3. Dependency. Your business performs a function another organisation relies on. A software provider supporting maritime operations, a port services company or an industrial maintenance contractor could create significant disruption if its services became unavailable.
4. Collateral. Your organisation suffers damage from an attack directed elsewhere.
NotPetya remains one of the clearest examples. The destructive attack primarily targeted Ukrainian financial, energy and government sectors in 2017, according to the UK government. Its indiscriminate design caused it to spread much further, affecting organisations across Europe.
The lesson is uncomfortable: an attacker’s intended target tells you little about how far the consequences might travel.
Which businesses carry the greatest exposure?
An organisation’s connections can make it strategically relevant even when its own operations appear ordinary.
Consider an MSP supporting energy companies, or an engineering contractor maintaining industrial systems. Both may hold privileged customer access. If attackers compromise those credentials, they could gain a route into environments with much greater operational significance.
Supplier access deserves particular attention. Remote-maintenance VPNs, cloud administrator accounts, shared service credentials and permanent vendor connections can all create entry points.
Operational dependencies matter just as much.
A shipping company might depend on a small number of providers for fleet management, vessel communications and shore-side operations. If one becomes unavailable, the resulting disruption could spread across several vessels or offices.
ENISA explored this problem in its Cyber Europe 2026 exercise, which simulated coordinated attacks against maritime and rail infrastructure. The scenarios included disrupted port logistics, navigation systems and railway operations. ENISA also identified legacy operational technology (OT), third-party dependencies and military logistics as factors affecting these sectors’ exposure.
The exercise was simulated, but the dependencies it examined are real.
For organisations in maritime, manufacturing, energy or logistics, this leads to a practical question:
Which external company could interrupt our operations if it became unavailable tomorrow?
If the answer is unclear, start there.
What should trigger a geopolitical cyber-risk review?
Monitoring every geopolitical development would overwhelm most security teams. A targeted review becomes more useful when something changes in your business or its exposure.
Three areas deserve attention.
- Strategic relevance. Perhaps you’ve won a defence contract, started supplying an energy operator, entered a politically sensitive market or acquired a company with government customers. Your relationship with a more strategically important organisation may change your risk.
- Threat activity. Conflict escalation, sanctions, sector-specific security warnings or increased state-linked activity can change the likelihood of an attack affecting your organisation.
- Technical exposure. A new MSP, privileged customer connection, remote-access service, cloud integration or OT connection changes what an attacker might reach.
Taken together, these create a useful review model:
Strategic relevance × Threat activity × Technical exposure
It’s a framework for deciding when to investigate further, rather than a numerical risk formula.
For example, suppose your manufacturing company has recently joined a defence supply chain. At the same time, a national cybersecurity authority warns of increased activity against that sector, and your company has just enabled remote maintenance access for a new contractor.
That combination deserves a focused review of identities, access permissions, monitoring and supplier relationships.
One important principle follows:
Your geopolitical cyber exposure can change because the business changed, even if the firewall didn’t.
What should you examine first?
The good news is that geopolitical cyber activity frequently exploits weaknesses security teams already understand.
The Volt Typhoon advisory documented techniques involving public-facing network appliances, compromised credentials, VPN access and attempts to maintain persistent access.
That makes several checks particularly useful.
Check access in both directions
Start with your organisation’s privileged relationships.
Identify which suppliers can remotely administer your systems, which of your employees can access customer environments and which accounts retain privileges after projects or contracts end.
Then examine how access is controlled.
Is multi-factor authentication mandatory? Are supplier accounts shared? Can sessions be monitored? Can you revoke access quickly without disrupting unrelated operations?
A particularly useful test is to take one privileged supplier account and determine exactly which systems it can reach.
If that account were stolen, how far could an attacker move?
Review the suppliers that could stop your business
Treat suppliers according to the operational consequences of their failure.
A vendor processing low-risk internal documents deserves a different level of scrutiny from the company operating your fleet-management platform or administering your production infrastructure.
For each critical supplier, establish what systems it supports, how long the business could operate without it and whether a tested alternative exists.
NIST’s Cybersecurity Framework 2.0 supply-chain guidance recommends considering cybersecurity responsibilities both when purchasing technology and when supplying products or services to others.
That second perspective matters.
An MSP needs to understand how its suppliers could affect its operations. It should also understand how a compromise of its own infrastructure could affect customers.
Map your critical business services
Begin with operations that have limited tolerance for downtime.
For a manufacturer, that might be a production line dependent on OT controllers, plant networking, identity services and specialist maintenance vendors.
For a shipping company, it could be vessel connectivity, shore-side systems or the applications required to coordinate fleet operations.
Document those dependencies and establish what would happen if one failed.
Then consider whether two failures could occur together.
The resulting map will show where technical weaknesses could create the greatest operational consequences.
Test a scenario that could actually happen
Most organisations already conduct some form of incident response or resilience testing.
The value depends heavily on the scenario.
Try this:
Your main MSP reports a cyber incident during a period of heightened geopolitical tension. Administrator credentials may have been stolen. Remote access into your environment has been suspended, several critical systems are unavailable, and investigators have yet to establish whether the attackers accessed your network.
Now test the decisions.
Who authorises the disconnection of supplier access? Which services stop working? Can internal administrators operate independently of the MSP? Who investigates possible compromise? How are affected customers informed?
And what happens if the supplier remains unavailable for 72 hours?
The exercise should produce specific findings: missing access records, excessive supplier privileges, unavailable recovery procedures, unclear decision authority or critical systems with no workable alternative.
A separate red-team exercise could test whether compromised supplier credentials would permit lateral movement into customer or operational environments.
For OT-heavy organisations, the exercise should also examine how an IT incident could interrupt physical operations.
Colonial Pipeline illustrates the connection. In May 2021, ransomware affected the company’s business systems. The operator subsequently disconnected certain systems used to monitor and control pipeline functions to prevent further compromise.
Although Colonial Pipeline was attacked by a criminal ransomware group, the case demonstrates how a compromise of business IT can lead to operational disruption.
That same dependency matters when assessing possible geopolitical attacks.
5 actions worth taking in the next 30 days
You can make useful progress without starting a large new security programme.
- Identify your five most critical operational dependencies. Record the business service, responsible owner, maximum tolerable outage and available alternative for each.
- Review privileged third-party access. Remove unnecessary accounts, check MFA coverage and confirm that access can be revoked quickly. Prioritise suppliers with administrative or OT access.
- Map your connections to strategically important customers. Include government, defence, infrastructure and other sensitive-sector relationships, especially where your organisation has technical access.
- Check monitoring on the systems that matter. Focus on VPNs, privileged identities, remote-management tools, cloud administrator accounts and connections crossing IT/OT boundaries.
- Run one cascading-disruption exercise. Select a critical supplier and test what happens when that supplier becomes unavailable while your organisation may also be compromised.
Each activity should produce an actual output: a dependency register, an access inventory, a monitoring gap, a remediation task or a tested recovery decision.
Those outputs give management something concrete to review.
What leadership needs to understand
Many decisions that change geopolitical cyber exposure happen outside the security department.
Sales enters a new market. Procurement changes a critical supplier. Operations connects another contractor to industrial systems. Management approves an acquisition.
Each decision can change the organisation’s exposure.
European policy increasingly addresses those dependencies. NIS2 includes supply-chain security among the cybersecurity risk-management requirements for covered entities, while the European Commission’s guidance also addresses the risks arising from suppliers and service relationships.
The board should therefore understand which business activities carry strategic relevance, where the organisation depends on external providers and how long critical services can withstand disruption.
Security teams should bring those answers into business planning whenever a major customer, supplier or operating environment changes.
Geopolitical risk is ultimately a dependency problem
The practical problem comes down to the relationships around your organisation.
Who relies on you? Who do you rely on? And what could an attacker reach through those connections?
Your company might be the intended target, a route towards another organisation, a critical operational dependency or an unintended victim of an attack elsewhere.
The right assessment starts by examining the access and dependencies that already exist, testing how they might fail and deciding which risks deserve attention first.
Because the question worth asking is:
Who could benefit from using, disrupting or moving through your organisation?
Where should you start?
Pick one critical supplier or business connection. Examine who has access, which operations depend on it and what would happen if that relationship were compromised tomorrow.
If you can’t answer those questions confidently, you’ve already found a useful starting point for your next cybersecurity assessment.
Stay ready. Stay resilient. Stay operational.
Curated with purpose, delivered with precision | ThreatScene Team
Sources
- Microsoft, Digital Defense Report 2025.
https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/bade/documents/products-and-services/en-us/security/Microsoft-Digital-Defense-Report-2025.pdf
- CISA, NSA, FBI and international partners, PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure.
https://www.cisa.gov/sites/default/files/2024-02/aa24-038a-jcsa-prc-state-sponsored-actors-compromise-us-critical-infrastructure_1.pdf
- SolarWinds Corporation, Form 10-Q, 2021.
https://www.sec.gov/Archives/edgar/data/1739942/000173994221000080/swi-20210331.htm
- UK Government, Foreign Office Minister Condemns Russia for NotPetya Attacks.
https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks
- ENISA, Cyber Europe 2026: All Eyes on the EU’s Collective Response and Resilience.
https://www.enisa.europa.eu/news/cyber-europe-2026-all-eyes-on-the-eus-collective-response-and-resilience
- NIST, Cybersecurity Framework 2.0: Quick-Start Guide for Cybersecurity Supply Chain Risk Management, SP 1305.
https://csrc.nist.gov/pubs/sp/1305/final
- U.S. Government Accountability Office, Critical Infrastructure Protection: TSA Is Taking Steps to Address Some Pipeline Security Program Weaknesses.
https://www.gao.gov/products/gao-21-105263
- European Commission, NIS2 Directive: Questions and Answers.
https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs
