Tech teamRunning a website or small org
Supply-chain attacks
A trusted supplier or code library is compromised - and so are you.
Understand it
A new standalone category in OWASP 2025. Rather than attack you, criminals compromise something you depend on - a library, a plug-in, a provider - and ride that trust into your systems. Much of the serious UK activity we have seen begins this way.
How to spot it
Hard to see directly: a dependency behaving oddly, an unexpected update, or news that a provider has been breached.
Close the gap
- Know what you depend on - keep a list of libraries and key suppliers.
- Pin versions and review updates rather than pulling everything automatically.
- Check a supplier’s security before trusting it with access or data.
- Follow the security advisories for the components you use.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.