Examining the Concentration of Cyber Risk: How supply chains and global economies can adapt

SecurityScorecard warns that cyber risk is heavily concentrated in a small set of large vendors whose expansive attack surfaces amplify systemic risk: adversaries are increasingly weaponizing third- and fourth-party vulnerabilities at scale (notably CVE-2023-34362 in MOVEit) and running broad campaigns by groups such as C10p, LockBit, and ALPHV/BlackCat, causing high-impact incidents like the Change Healthcare outage; the report recommends identifying single points of failure, continuous external attack-surface monitoring, automated vendor detection, and operationalizing vendor cybersecurity management to improve resilience.