There are some interesting things that come out of the WWF report Global Cybersecurity Outlook 2026 (WEF_Global_Cybersecurity_Outlook_2026.pdf), but today I'll write about one: risk doesn't just sit „in our network.” It sits in the dependencies.
The report paints a simple picture: the digital supply chain is so interconnected that a breach at one supplier can go through the entire ecosystem - production, operations, customers and... subsequent suppliers. The problem is that these dependencies are often not even decently mapped.
What does GCO 2026 say about the direction we are going?
The report lays out the reality of 2026 in several hard trends:
- AI speeds everything up- Defense and offense. It gives fuel for automation, but also for scaling abuse. Organizations don't know where AI has access.
- Geopolitics is not letting up- affects defense strategies, supply chains and trust between partners.
- Cybercrime acts like a business, and fraud is growing because it is cheap and effective.
- Resilience (resilience) becomes the language of management- Not „whether there will be an incident,” but „whether the company can withstand it.” Azimuth probably won't be able to withstand -. Restructuring at Azymut wholesaler - Bankier.pl
And now the most important for me - The supply chain you can't see. GCO 2026 describes two aspects that overlap:
- Opacity (no visibility)- Companies do not have insight into the „extended chain,” that is, in practice, in the fourth parties(our suppliers' suppliers).
- Concentration risk- Over-reliance on a few critical suppliers/services.
The report also gives a strong example of the „domino effect.” An incident in the check-in and boarding systems used by several major airports in Europe (September 2025). The study's authors call it a relatively „minor breach,” and it still ended in a cascade of flight delays and cancellations. And a phrase that sticks in the mind: what if a similar attack had hit hospitals or other critical infrastructure?
On top of that, the number is hard to miss: 65% large companiesidentifies third-party and supply chain vulnerabilities as the biggest barrier to building cyber resilience (up from 54% in 2025).
The study directly identifies „top risks” in the supply chain:
- inheritance risk(You are not able to ensure the integrity of someone else's components: software/hardware/services),
- visibility(no visibility),
- concentration risk(concentration).
Notepad++ as an example of a „small element” that creates a big problem
This dovetails perfectly with the Notepad++ story: there, it wasn't about a „big banking platform” but a confidence in the update mechanismand about someone taking over a piece of the update delivery infrastructure able to give a malicious installer to selected victims.
This is exactly the same mechanism that GCO 2026 talks about: one dependency, a weak point, and then a cascade of critical events.
What's in it for „tomorrow” (no revolution)?
Without a dependency map, there is no risk management. And without numbers, there are no priorities.
Three practical steps worth taking even in a medium-sized company:
- Start with critical services(not from the list of suppliers) and only to them add suppliers + subcontractors + hosting + key components.
- Constantly monitor IT assets, exposure changes, leaks, unusual updates, new dependencies.
- Count the scenarios: what happens when a „vendor update” becomes an attack vector. This is where quantitative risk assessment/valuation comes in, because otherwise everything ends up being intuition.
Risk assessment applies not only to IT, but also to purchasing teams. The price factor is important, but it can also be (or now is) important to assess trust in the supplier.
Contact the author and schedule a free consultation: https://outlook.office.com/book/Konsultacjewobszarzeaplikacjibiznesowych@ISCG.onmicrosoft.com/s/fKddgNyppECh3KThb8VNMw2?ismsaljsauthenabled