5 Supply Chain Predictions for 2025 Report – Download NOW!

Filter by Categories
Interview
News
Filter by Tags
survey
Filter by Resources Categories
Report
White Papers

Category: Perspective

Supply Chain Predictions for 2025: How Geopolitics, Cybersecurity, Tariffs, Climate and AI are Reshaping Risk Management

Posted on by interos.ai

In a recent webinar, “5 Supply Chain Predictions for 2025,” industry leaders Ted Krantz, CEO of interos.ai, Andrea Little Limbago, PhD, SVP of Applied AI at interos.ai, and Dave Dewalt, Founder and CEO of NightDragon, discussed the major disruptions reshaping supply chains and risk management. From geopolitical instability to the rise of AI-powered solutions, the conversation highlighted the emerging threats that companies will need to navigate in the coming years. 

Geopolitical Instability: A Triple Threat to Supply Chains 

Geopolitical tensions continue to have a profound impact on global supply chains. Regions like Eastern Europe, the Red Sea, and the South China Sea are causing significant disruption. Ted shared, “You’ve got a combination of sanctions and restrictions that are trying to operate in a world with limited borders, but you still have to insert some of these components to have some semblance of control and safety in terms of the global supply chain.” The potential for a trillion-dollar economic impact was raised, emphasizing how intertwined businesses are with high-risk areas. 

Dave added, “Geopolitical risk is becoming an existential risk area for nearly every company, understanding not just what vendors you buy from, but what vendors they buy from is critical.” He emphasized the importance of having visibility into the entire supply chain, including second, third, and fourth-tier suppliers, to avoid catastrophic disruptions. 

Cybersecurity: Convergence of Digital and Physical Risks 

Cybersecurity threats are no longer limited to digital systems alone; physical infrastructure is now at risk too. Dave noted the increasing number of cyberattack groups, saying, “There are over 3,000 cyber-attack groups now worldwide. This number is up dramatically since COVID, and it’s not just nation-states; you’ve got criminal groups and hacktivist groups.”  

The growing sophistication of cyber adversaries and the integration of digital technologies into physical systems, such as satellites and undersea cables, means the risk landscape is widening. 

Andrea also pointed out the ripple effects unknown physical components can have: “One thing that gets overlooked is how countries are moving toward data localization and sovereignty. Many countries require data to be stored within their borders, and companies often don’t even know where their data is stored. This raises serious concerns about data security and compliance.“ 

To manage these evolving threats, the panel stressed the need for comprehensive real-time monitoring and a holistic view of both digital and physical risks. 

Trade and Tariffs: The Economic Gamble 

The ongoing trade tensions, particularly between the U.S. and its primary partners China, Mexico, and Canada, have introduced a new layer of complexity to the global supply chain. Ted described tariffs as “the biggest wildcard for supply chains in 2025.”  

In particular, the automotive, technology, and agricultural industries are expected to bear the brunt of trade restrictions. Ted noted the complexity of the trade relationships between the U.S. and its neighbors: “Take the automotive industry. It’s highly connected between all three countries—Canada, Mexico, and the U.S. Trying to pull apart that supply chain could be extremely difficult and costly.” 

Dave reinforced the idea that trade wars are becoming a board-level issue, stating, “Companies today are not monitoring every event across every layer of their supply chain. If you’re not looking at your second and third-level suppliers, you’re putting your company at risk.” 

The panel urged companies to reassess their supply chain structures, considering how each layer beyond their direct suppliers could be affected by shifting tariffs and trade policies. 

Climate Change: The Growing Impact of Extreme Weather 

Extreme weather events and the intensification of climate change are creating more significant challenges for businesses. Data from interos.ai shows, in 2024, 9,800 extreme weather events affected nearly 95 million companies, a 50% increase from the previous year.  

Companies in sectors such as energy, healthcare, and agriculture must begin factoring climate risks into their operational strategies. As Andrea emphasized, “The key for businesses is not just mitigating their environmental footprint but also adapting to climate disruptions that could hit their infrastructure. Companies need to look beyond just ESG policies and to proactive action.” 

Dave pointed to a large energy company that was impacted by 17 storms and 49 tornadoes in a single quarter, noting, “They had to account for the operational impact of these weather events, and it was a major financial hit.” He emphasized that boards of directors are paying more attention to how climate change affects their business, not only in terms of operations but also in terms of earnings. 

Ted added, “Companies need to integrate climate risks into their overall risk management strategy. Catastrophic weather is no longer an isolated issue; it’s a critical part of the risk landscape.”  

The message was clear: businesses can no longer afford to treat climate change as a distant threat—it must be incorporated into daily operations and decision-making. 

AI and the Supply Chain: Secure AI is Key to Mitigating Risk 

Embedding AI technologies in supply chain operations brings both tremendous opportunities and complex associated risks. Ted explained, “Throwing AI agents blindly everywhere across your enterprise is incredibly dangerous. You have to think carefully about the input and output of AI models and secure them at every step.” 

AI models that are not carefully managed or securely integrated can introduce significant risks, from misinformation to system failures. 

Dave underscored the importance of managing and mitigating security risks, saying, “CISOs today are focusing more on AI risks. You must have visibility into how AI tools are being used across your organization.” 

Andrea touched on the gap in global AI governance and emphasized, “We really need democracies to come in and set guardrails for infrastructure and use cases, to allow innovation to flourish and prevent the more harmful effects.” 

Dave closed out the session highlighting a key concern in open-source AI environments: “Data chaining is a real issue because when you combine your data with someone else’s, the question becomes: who owns the intellectual property on that data? What risks do you face in terms of the data’s origins?” 

By embracing a comprehensive, data-driven approach to risk management, companies can better navigate the complexities of 2025’s supply chain environment. 

Catch the full conversation on-demand today: 

Retaliation and Economic Uncertainty: The High Stakes of Trump’s Tariff Policies

Posted on by Andrea Little Limbago

Author: Andrea Little Limbago, PhD, SVP, Applied AI  

Not with a Whimper, but with a Bang 

The rules-based system and international collaboration that has guided the global economy for decades – and quite possibly produced the greatest reduction in worldwide poverty in history – may have come to an end.  

With the strike of a pen, the United States is implementing 25% tariffs on allies Mexico and Canada (10% on Canadian energy), coupled with a 10% tariff increase on China.  

The delay and uncertainty around the timing and implementation of the tariffs adds an additional level of disruption, that if comes to fruition, would likely mark the end of a global economic system that already was feeling the weight of trade wars, geopolitics, and import controls.  

However, this is not simply continuity of the shifts underway since the beginning of the U.S.-China trade war almost a decade ago. The tariffs are an escalation of trade barriers aimed at the U.S.’ top three trade partners, but also two of its closest allies. In fact, President Trump has identified other U.S. allies – the European Union and United Kingdom – as potential upcoming targets of tariffs as well. This is a dramatic shift from the ongoing re-globalization of the global economy and supply chains along geopolitical fault lines and is a much more aggressive adoption of the economic nationalism and the mercantile policies that undermined globalization almost a century ago. 

Supply Chain Disruptions, Again 

Geopolitics has driven the global restructuring of supply chains, leading to the expansive and unprecedented implementation of industrial policy. However, ally or friend-shoring remained at the heart of this restructuring, with both the U.S. and China building out their economic spheres of influence along with like-minded countries.  

These tariffs – if fully implemented – would be a huge blow to post-World War II alliance structures. 

Moreover, the tariffs come at a time when China is shaking up the AI and technology landscape and is strengthening collaboration with many of the U.S. geopolitical adversaries.  

Given the hyperspecialized, complex, and geographically dispersed nature of supply chains, one country alone cannot simply provide all parts and components for emerging technologies, let alone less strategic industries.  

At a time of heightened strategic competition and technological shifts, the tariffs would introduce yet another major disruption to supply chain risk.  As the next section details, given the size of the trade flows, very few companies will be immune from the impact of these tariffs. 

Products and Industries at the Greatest Risk 

The 25% tariff impacts goods flowing into the U.S., serving as a tax on the price of these goods domestically. Based on trade data from Canada and Mexico combined since January 2024, and leveraging interos.ai’s product and industry categorization that are based on self-attestations of a company’s industry and products, the following tables highlight the key products and industries at risk across the 10.5 million number of import shipments into the US.  

The major industries impacted range from software and IT to retail and banking and financial services, while products generally include underlying components such as plastic, rubber and iron and steel, indicative of the economy-wide impact of the tariffs. 

Both Mexico and Canada have vowed retaliation, and highlight similar dependencies across industries and products, demonstrating the hyperspecializing and interdependency of the three economies. 

In contrast, the major industries and products impacted by the additional 10% tariffs on Chinese imports highlight a consumer-facing impact as well, with consumer goods and retail among the top industries impacted, although industrial equipment and construction clearly demonstrate the diverse range of industries that will be affected. 

 

The top 10 products imported by US companies from Canada and Mexico make up over 40% of all 10.5 million shipments in total.

Preparing Supply Chains in a Volatile Setting 

As of this writing, the tariffs on Mexican and Canadian imports are delayed one month, in return for additional troops along the border. There is no word yet on a similar delay to those imposed on China. The shifting nature adds to global uncertainty, which only fuels greater risk and market fluctuations.  

The only certainty here is on-going change and disruption, as these tariffs upend decades of rules-based order that has driven globalization and supply chains. 

Across the globe, markets fell in response to the weekend’s tariffs news and impending trade war expansion.  

For supply chains, decisions made now often take years, not minutes, to implement. 

Whether or not to shift operations, for example, has a long-term impact and therefore this growing uncertainty is forcing many to reassess their global footprint amid such potential shifts.  

Overhauling supply chains, yet again in some cases, is expensive and time intensive. The unpredictability presented by the tariffs only adds to supply chain risks, especially in geographies until very recently deemed stable and less risky.  

From higher prices to operational disruptions to economic shocks, interos.ai is closely monitoring the situation and how it is impacting supply chains and the global economy. 

For more on our take on how geopolitics, tariffs, trade, cyber and poised to wreak havoc on supply chains in 2025, read our latest report.  

Get your copy of the 2025 Supply Chain Predictions Report Today:  

Forget the Super Bowl, the Real Monday Morning Quarterbacks are Targeting AI

Posted on by Andrea Little Limbago

Author: Dr. Andrea Little Limbago, SVP, Applied AI, interos.ai 

“DeepSeek R1 is AI’s Sputnik moment” claimed Marc Andreesen following their announcement of the open source reasoning model that rivals those made by Silicon Valley tech giants at a fraction of the compute.  

Last week, the Chinese startup launched an open source AI assistant that by Monday had become the number one downloaded app on Apple.  

Concerns over this breakthrough instigated a $1 Trillion loss in tech stock shares and have reignited the debate over closed versus open systems. 

Whether or not this is a Sputnik moment, there are many prognostications surrounding this release. While it is too early to know the long-term impact of this latest shock to the AI world, it is important to both take this breakthrough seriously while also not jumping to the wrong conclusions.  

The discourse is certainly going to evolve, but this is not the time for quick conclusions about strategic priorities that will shape the future of AI and geopolitics. 

  1. Stargate is not necessary: Many are wondering whether DeepSeek will ‘deep-six’ Stargate, President Trump’s $500 B AI project aimed at developing AI infrastructure in the US. For years, technological bifurcation – the splintering of the physical infrastructure that serves as the backbone of the digital world – has created a divergent system between Chinese backed technologies and those produced by the US and like-minded countries. Governments are moving toward greater data sovereignty and tech sovereignty under the auspices of national security. Stargate is a natural progression of this movement. Given recent attacks on physical infrastructure, including on ViaSat as well as underseas cables, maintaining tech sovereignty over the infrastructure that powers AI is part of the broader global splintering of the internet and technological infrastructure into technospheres. If anything, DeepSeek’s announcement will only deepen this growing divide. 
  2. Export controls don’t work: US export controls on the most sophisticated chips inadvertently sparked innovation by requiring Chinese companies to do more with less, or so the argument goes. Export controls will never be perfect, but that does not mean they may not be effective. The array of tech-related export controls have made it much harder for China to develop their own semiconductor industry, and perhaps is better compared to tech containment. Whether its enforcement challenges, or the notion that you can’t ban math – to pull from arguments over encryption bans in recent years – make AI technologies easier to circumvent than other emerging technologies. 
  3. Security as an afterthought: With record-breaking downloads, yet again we are witnessing the flight to new tech with security as an afterthought. Nevertheless, DeepSeek had to halt new registrants due to ‘large-scale malicious attacks’. The security risks not only pertain to DeepSeek, but rather include the broad range of attacks, from data poisoning to model corruption. But wait, there’s more. China’s data policies enable the government to access data from companies located in China. Furthermore, given the tight connection between the government and companies, it is naïve to assume complete separation of the Chinese government from DeepSeek going forward, including manipulation and backdoors. 
  4. Authoritarian regimes have the innovation edge in AI: While this has not been a prime take-away this week, there has been a growing debate about which regime type has the AI edge, largely based on the greater access to all kinds of data by authoritarian regimes. However, it ignores the censorship and propaganda that can poison the AI models. Existing Chinese GenAI models have already demonstrated censorship and disinformation, and initial research shows DeepSeek’s AI suffers the same problem. Garbage in, garbage out may give democracies the edge, including in reasoning models. 

 

Over a decade ago, Edward Snowden’s revelations helped deepen the divide between Silicon Valley and DC. DeepSeek may finally be the impetus that brings the two group together. Is this the spark that rejuvenates the close allegiance between the tech sector and the US government, similar to Hewlett Packer, Texas Instruments, and IBM from the early days of the Cold War?  

Will the AI-focused export controls passed earlier this month target DeepSeek before it becomes a TikTok regulatory problem? If so, how will China retaliate?  

The only certainty is that we are still in the early days of this generation-defining technology. AI is more than the technology, but must be viewed through the regulatory, national security, and social systems lens in which it is deeply intertwined. 

Go Deeper:  What’s in Store for 2025 

You can view our take on the 5 trends to look out for in 2025 in our latest report, including our breakdown on the need for Secure AI and the larger Bifurcation of technology along geopolitical fault lines:   

Interim Final Rule on Artificial Intelligence Diffusion

Posted on by Andrea Little Limbago

Author: Dr. Andrea Little Limbago, SVP, Applied AI, interos.ai 

To kick off the New Year, Russian President Vladimir Putin ordered the Russian government and its major bank to coordinate AI development with China. This announcement followed a similar one a few weeks earlier wherein Russia highlighted collaboration among the BRICs (Brazil, Russia, India, and China) and South Africa for an AI alliance.  

These announcements, in turn, coincide with a steady drumbeat of AI-driven techno-alliances among the US and its allies, including those between the EU and US, within the QUAD, as well as adjacent policies such as the CHIPs Act and the US AI Executive Order.  

Yesterday’s Interim Final Rule on Artificial Intelligence Diffusion is the latest global policy aimed at technological diffusion within allies, which continues to deepen the growing technological bifurcation and upend global supply chains. In the race to implement AI, organizations must stay atop the global technospheres of influence, which will continue to reshape corporate technology stacks or else introduce new security and regulatory risks. 

Summary of Bifurcation 

The latest wave of AI-focused, technology alliances is a continuation of a pattern that has been going on for years. Technospheres of influence have emerged, wherein part of the world is building upon largely Chinese-created technology infrastructures, and other parts on those built by US and allies.  

The US-China trade war initially instigated the nascent splintering almost a decade ago and was followed by US and European export controls and sanctions targeting thousands of companies in China and Russia. China, in turn, has an Unreliable Entity List, which saw the most recent additions on January 2 with the announcement of the addition of ten US defense companies. 

These policies have accelerated, both with the increase of geopolitical tensions, but also due to the growing awareness of sanctions circumvention and the use of US-created technology by Russia against Ukraine.  

Both the EU and US have specifically targeted distinct rounds of sanctions with anti-sanctions circumvention goals. The result, so far, has been a widening of geographic divisions of technology stacks dependent on geographic location and geopolitical alliances. 

Potential Impact 

This latest Interim Rule targets foundational AI technologies, including automatic data processing machines, electronic integrated circuits, semiconductors, and calculating machines. The Interim Rule specifically encourages the exchange and research collaboration in these product areas with 18 allies, while restricting their access to ‘non-trusted actors’, a consistent thread among the series of other US AI-related policies over recent years. 

Interos.ai identified over 27,000 companies in the US who export these four very specific product categories. These companies, in turn, have global footprints across non-trusted countries and allies alike, as detailed in the table below. Over 20% of companies buying directly from these US companies are in Mexico, followed by India, Great Britain, Colombia, and Canada.  

China is among the top 12 direct customers producing one of these products: automatic data processing machines, electronic integrated circuits, semiconductors, and calculating machines. Under the Interim Rule it is assumed that these products could be used in AI technologies.  

As you see in the table above, there are thousands of companies who purchase the four product areas listed above. Over 650 of these are in countries of concern, such as China, Russia, and Iran, which exceeds one thousand when looking into the third tier. Meanwhile, almost 4,000 companies are among the 18 allied countries listed in the Interim Rule, and over 3,700 tier 3 companies.  

This highlights both the risks and opportunities for companies in complying with the Interim Rule, wherein sizable mats already exist for expansion among like-minded democracies. At the same time, this also illustrates the increasing challenge of doing business in at-risk or adversarial countries.  

While these numbers focus on very small, niche product categories, they often are components of much bigger and broader product technology ecosystems.  

To that end, when looking at the US tech industry writ large, interos.ai data reveals almost 575,000 companies globally that are directly supplied by a company in the US tech industry. The biggest direct importers from the US technology industry are concentrated in the United Kingdom, India, Australia, Canada, and Mexico.  

US AI Policy in Transition 

As we noted last Fall, AI governance is critical for shaping the global rules of the road when it comes to AI development, deployment, safety, and security. The EU released the first comprehensive AI policy last year, while the Executive Order and Blueprint for the AI Bill of Rights are the most comprehensive frameworks from the US, but lack the regulatory teeth. 

 In addition, as often occurs with leadership transitions, there is uncertainty surrounding how the next administration will approach AI. The AI Executive Order is expected to encounter additional scrutiny, with potentially getting repealed based on comments made by the incoming Trump administration. However, based on an AI executive order late in 2020, there are likely areas of continuity as well, indicating that AI policy will remain a moving target. 

Geopolitical Tensions will be Central to the Shifting AI Regulatory Landscape in 2025 

Given the fast pace and broad impact of AI, the only certainty around the global AI regulatory landscape is that there will continue to be shifts and changes, with geopolitical considerations central to these changes. While the new Interim Rule is the latest example of AI-driven governance updates, it will not be the last.   

The geopolitical landscape will continue to drive technological bifurcation, creating distinct technospheres of influence among the US and allies in contrast to China and like-minded regimes. 

In addition, we can expect to see changes in AI policies focused on enhancing the underlying security and safety fundamentals of AI.  AI security concerns are likely to come front and center in 2025.  

On the security front, these will focus on minimizing adversarial AI, including prompt injection attacks, data poisoning, and model manipulation. There also are safety concerns, and we can expect the use cases of specific AI to drive regulatory practices, with higher safety use cases attracting greater regulatory oversight compared to low risk use cases. 

The first two weeks of 2025 have already proven eventful for the global AI regulatory landscape. With AI proving to be a generational technology, not only is technological innovation critical, but so too are the governing frameworks surrounding it.  

interos.ai views secure AI as a growing and critical consideration for supply chain, full of both opportunities and challenges. We work closely with our customers, supporting their AI governance frameworks and serving as strategic partners to guide AI governance decisions. 

To learn more about it and other major trends for 2025, download the interos.ai 2025 Predictions Report. 

5 Supply Chain Predictions You Need to Know in 2025

Posted on by interos.ai

2024 was a transformative year – reshaping how we view supply chain risk. Supply chains make the world go round – and can also bring it to a screeching halt.  

Specifically, we saw the nonreversible merging of the physical and digital supply chain.  

Supply chains are not simply the shipping of goods but the underpinning of sharing information. No one will forget how the Crowdstrike outage grounded flights, locked banking transactions and impeded business operations – showing it’s not just a physical supply chain that we need to be concerned with, or how the Hezbollah device attacks showed a sophisticated weaponization of the physical supply chain, signaling a new era of modern warfare.  

interos.ai’s inaugural Predictions Report walks through key highlights from 2024 as well as  markers to be on the lookout for as we move into 2025. 

Geopolitical 

2024 was the year of democracy – there were over 80 elections globally, and half of the world’s population voted bringing global election security to the forefront of cybersecurity and disinformation professionals, worldwide.  

US Sanctions ramped up with more entities being added by the U.S. Department of Homeland Security ‘s Uyghur Forced Labor Prevention Act (UFLPA) entity list, bringing the total to over 100 organizations and more than $3.4 billion worth of goods being reviewed in two years. Separately, though just as significant, the Office of Foreign Assets Control (OFAC) sanctioned the last of the top three Russian financial institutions as part of the U.S. efforts to aid Ukraine in the Russia-Ukraine war.  

Trade, Ports and Labor Strikes 

Labor strikes loomed in Canada, India and the US, with talks resuming for the International Longshoreman’s Association (ILA) in 2025. 40% of goods traded to the U.S. on any given day go through ILA controlled ports with trade increasing 25x since the last full ILA strike in 1977. The economic fallout of a full labor strike could be catastrophic.  

The Baltimore bridge collapse added significant cost and congestion to the automobile, energy and manufacturing sectors as imports were diverted to other ports. Baltimore is the top port in the nation for automobile shipments and a crucial hub for coal exports. 

The ripple effects of damage to just one U.S. port shows the fragility of supply chains and underscores the need for proactive risk management.  

Climate-Induced Supply Chain Disruptions 

Historic storms Hurricane Helene and Milton bore down on the U.S. in 2024 impacting core manufacturing, aerospace, agriculture and medical industries with extended supply chains comprised of over 2 million businesses.  

Supply chains have seen the competitive rise of ESG and sustainability. Global legislation is requiring organizations to focus on ethical and environmental practices or face steep fines and reputational damage. The impending EU’s Deforestation Regulation has upped the ante for businesses to have visibility and eliminate ties to risky products in their supply chains. Globally governments continue to mandate ESG and climate reporting, such as Australia’s recent legislation for climate-related financial disclosures.  

As we look ahead to 2025, two things are certain:  

  • Supply chains are the vast and sprawling connective tissue powering our economy 
  • Eliminating risks in supply chains is more than ad hoc risk management, it is a requirement for healthy business. 

Get your copy of the 2025 Supply Chain Predictions Report Today:  

Hezbollah Device Explosions: A Stuxnet Moment for Supply Chain

Posted on by Andrea Little Limbago

Author: Dr. Andrea Little Limbago 

An Inflection Point

Almost six years ago, Bloomberg published a report on Chinese government infiltration of 30 US companies through the technology supply chain. This report was highly controversial within the cybersecurity community and remains openly disputed regarding the validity of inserted ‘spy chips’. Since then, there has been less focus on infiltrated technology supply chains, as the pandemic and trade wars shifted attention away from espionage and toward more traditional industrial policy and risky businesses within the supply chain ecosystem. 

On September 17 and 18, 2024, infiltrated pagers and walkie talkies exploded across Lebanon, escalating the decades-long conflict between Israel and Hezbollah. While investigations remain ongoing, reports point to Israel infiltrating a complex supply chain of devices sold in Hungary, and authorized to sell on behalf of a Taiwanese company, Gold Apollo. While the company sold devices to the broader population, those sold to Hezbollah contained the explosive PETN. As more information becomes available, a picture will likely unfold of complexity and extremely targeted backdoor infiltration of a technology supply chain.  

This past week’s attacks in Lebanon are an inflection point, expanding technology supply chain risks toward supply chain sabotage, and shifting all rules of engagement in supply chain security and modern warfare. Whether or not ‘spy chips’ occurred in the past, given the shift in norms, a line has been crossed, rendering technology supply chain infiltration a growing supply chain security risk in a tenuous geopolitical environment. 

New Rules of Engagement in Modern Warfare 

The supply chain infiltration behind the attacks is on such a distinct scale and scope, it is reminiscent of the turning point from the Stuxnet cyber attacks, described as the world’s first digital weapon. In 2010, reports surfaced that several zero days exploits simultaneously sabotaged Iranian nuclear enrichment facilities. Most research identifies U.S. and Israeli intelligence as the creators of the exploits, which weren’t widely noticed until they spread beyond the Natanz facility.  

Viewed as the first digital weapon to cause physical damage, it shifted all cyber norms and rules of engagement and opened Pandora’s Box to the modern cyber threat landscape. From the 2012 Saudi Aramco attacks where wiper malware destroyed over 35,000 computers to Russia’s BlackEnergy cyber attacks on the Ukrainian energy grid in 2015 and 2016 to Saudi Aramco to Iran’s failed penetration of New York’s Rye dam, physical infrastructure by cyber attacks is no longer unexpected or unprecedented. In fact, earlier this year FBI director Christopher Wray detailed how China is burrowed deeply within US infrastructure.  

The Tipping Point for Security Risk 

In a similar manner, just as Stuxnet upended the norms of cyber behavior and physical destruction, the explosive devices used against Hezbollah will upend all norms behind supply chain infiltration and destructive effects. There already has been a growing national and economic security concern over risky businesses within the supply chain ecosystem. Since 2016, the US has added thousands of companies to a range of sanctions lists, many of which are deemed national security risks.  

Five years ago, the Pentagon blocked military from purchasing phones made by Huawei and ZTE due to national security risks. This has been a growing trend across the globe, as India blocked Chinese apps, China blocked Kaspersky and Semantic, Australia removed Chinese security cameras and so on. These have often been coined backdoor risks, as companies legally enter a supply chain ecosystem without any need for obfuscation. 

These have generally focused on software, not hardware, backdoors into systems. Last week, we may have witnessed the tipping point for hardware backdoor supply chain security risk based on the insertion of illegal or unknown physical parts. While distinct in its execution, there has been growing concern over the security of the hardware supply chain. 

The US CHIPS and Science, in part, targets this risk by incentivizing the manufacturing of semiconductors domestically. Nevertheless, the exploding devices manifest the real-world impact when foundational technologies are used as Trojan horses to carry out military objectives. As we have seen with Stuxnet, once that Pandora’s box is opened, it is a game-changer in the risk landscape and global norms. 

How Can Companies Protect Themselves in this New Norm? 

To prepare for yet another significant disruption shaping the new normal, there are several steps organizations can take.  

First, foundational risk approaches still hold true but require even greater diligence. Perfunctory risk processes are inadequate for this risk landscape. Know your supplier (KYS) takes on even greater importance, not just within direct suppliers but across the entire supply chain ecosystem. This, in turn, requires augmented visibility across your supply chain, a difficult feat due to the hyperspecialized and complex supply chains built over the last few decades where geopolitics was not taken into account. 

Gaining that visibility is just the start, additional context is required. For instance, are any of the thousands of restricted companies present several tiers within your supply chain? In many cases, these companies have already been linked to data exfiltration, it is not a great leap to consider hardware infiltration from these same technology companies.  According to Interos data, 148 (~30%) S&P 500 companies have a direct supplier relationship with a banned company, risking severe civil and criminal penalties, 19% of which are in the Computer and Electronic Product Manufacturing industry.  Beyond these direct (tier-1) suppliers, virtually every S&P 500 company has sub-tier (tier-2, tier-3 and beyond) supplier relationships with at least one at-risk or restricted company.  

This has always posed a regulatory risk, but the national and economic security risks must also feature in supply chain security risk assessments. While last week’s attacks were not via a restricted company, those technology companies on restricted lists represent a more probable pathway to hardware infiltration and warrant heightened alert. 

Tracking the latest in restricted companies is difficult as there is no single consolidated list across all U.S. and international organizations. Fortunately, Interos simplifies this process by surfacing several dozen restrictions lists across the US, Five Eyes, and international governmental organizations, extended across the entire supply chain ecosystem. These companies, especially those in technology, are at the highest risk of technology supply chain infiltration. These companies do not only pose a regulatory risk but could also interdict data or sabotage on behalf of adversaries. 

The stark reality of this new era is that the geopolitical risk stems much broader than restrictions – companies and governments need visibility into all areas of supply chain risk: financial, cyber, ESG, geopolitical and catastrophic risk.

In short, the globalized era of entangled supply chains absent geopolitical considerations is over. 

Supply Chain Security: Time to Double Down 

Almost a decade ago, the fictional political thriller Ghost Fleet imagined a future war beginning with supply chain infiltration. In this futuristic scenario, China hacks the U.S. electronics supply chain, disrupting everything from navigation systems to fighter jets. The digital revolution – or the fourth industrial revolution – continues to shorten the time frame between futuristic scenarios and modern reality.  

As Stuxnet demonstrated almost fifteen years ago, the shifting cyber attack landscape quickly expanded beyond governments and into the public sector. The device explosions in Lebanon similarly crossed a new line and will accelerate the pace at which the technology supply chain is exploited by government and non-government actors alike. Whether the Bloomberg report proves valid or not, the supply chain infiltration of the devices introduces similar supply chain security risks – it’s no longer a matter of if, but when a technology supply chain infiltration will occur again.  

Just as software backdoors have increased in prevalence, the same may soon be true of hardware backdoors, making it all the more critical for a fresh look and reprioritization of supply chain security. 

We are here to help.

 

 

Taming Digital Supply Chain Threats: NYSE CISO’s Battle Plan for the AI Era

Posted on by Dianna ONeill

Author: Dianna O’Neil 

In Interos’s latest Voices of Innovation session, NightDragon Founder & CEO Dave DeWalt, tackled today’s new breed of digital supply chain threats with Steve Pugh, Chief Information Security Officer (CISO) of the Intercontinental Exchange, Inc., better knowns as the New York Stock Exchange. As CISO, Pugh is responsible for securing critical economic infrastructure across multiple subsidiaries, geographies, and regulatory jurisdictions. 

Together Pugh and DeWalt explore the fluid landscape of digital risk and the critical role of AI supply chain risk intelligence in addressing escalating threats.  

Speed and Scale: The Core Challenges 

Pugh emphasized that the fundamental issues in digital supply chain risk management are the speed and scale of dispersed and sophisticated threats originating from bad actors, cyber criminals, adversarial nations, and other dynamic and fast-moving entities all over the world. “The key for a lot of my peers and colleagues is how do we keep up and innovate at that same speed [as bad actors], and then match the scale?” Pugh emphasized the staggering complexity of today’s attacks underscore the need for rapid adaptation and scalable solutions in the face of evolving risks. 

Building on this, DeWalt described the current global threat environment as “the perfect supply chain risk storm,” highlighting flashpoints with implications for digital supply chain stability.  

  • Heightened geopolitical tensions 
  • Regional conflicts 
  • Shifting dependencies on nations 
  • Increased cyberattacks targeting supply chains and third-party providers 

Unmasking “Unknown Unknowns”

Against this backdrop, Pugh noted the need to effectively communicating supply chain risk to high-level stakeholders, including corporate boards, to align on critical threats and move from insight to action, aided by emerging technologies that allow enterprises to take a proactive security posture. 

Pugh emphasizes two domains: visibility and control. “At the board level, we talk about it in two domains. The first is visibility, and then the second is control. And you really can’t talk about control unless you have the right level of visibility in your supply chain.” He focused on the critical importance of comprehensive supply chain visibility, using AI risk mapping and monitoring, as a prerequisite for effective risk management. 

Pugh elaborated by referencing Donald Rumsfeld’s “known knowns, unknown knowns, and unknown unknowns” matrix. He stated, “There’s a lot of unknown unknowns… that’s where the complexity really gets tough.” To illustrate this complexity, he shared an example from the experience of colleague at external engineering firm: that person experienced a catastrophic incident caused by “one bolt from a supplier somewhere in the world” failing—not due to malice but simply due to negligence or defect. He drew a parallel with third-party software and technology providers, noting how vulnerable third-party software solutions from obscure tiers of the supply chain can have significant consequences across interconnected digital supply chains. 

AI to the Rescue

Both DeWalt and Pugh expressed optimism about the role of AI and advanced risk intelligence in addressing supply chain challenges, particularly the ability of AI to deliver enhanced visibility and risk analysis at speed and scale. 

AI enables the ingestion and analysis of vast amounts of data from various sources, providing insights into complex supply chain relationships in real-time. Pugh explained, “AI can come alongside us and almost be a companion, to scale up and do so at speed and reason over all of these different data points.” Given the hundreds of millions of businesses globally, with billions of sub-tier supply chain interdependences, this capability is crucial for managing multi-tier risks effectively. 

Pugh detailed three primary ways AI is enhancing software development and security: 

  • Reasoning over code to find and fix defects quickly 
  • Generating cleaner, more secure code 
  • Enabling co-development with AI for native integration 

“We end up in this place where… you end up with some really good code that has fewer defects,” Pugh noted. He elaborated on how AI can create a “virtuous software development cycle” that significantly reduces potential vulnerabilities over time. 

Converging Physical and Cyber

Pugh’s role at NYSE encompasses both physical and cybersecurity—a trend that DeWalt sees increasing across industries. This convergence allows for a more comprehensive approach to risk management since physical threats can impact digital assets, unleashing a ripple effect with devastating financial consequences. 

Amid these changing dynamics, Pugh sees the CISO role evolving into that of a “risk business partner” to company leadership. “I think the role of the CISO is evolving to become more of a risk business partner,” he explained. This broader perspective allows for a more holistic approach to security and risk management across an organization. 

Channeling Optimism

As digital supply chain risks continue to evolve and expand, integrating AI technologies and continuous supply chain lifecycle risk intelligences alongside converging physical and cybersecurity offers promising solutions. Pugh’s final thoughts reflected a promising outlook: “I am optimistic on AI… I think it’s something that will certainly help us.” By embracing these generational innovations while maintaining a real-time view of risk management, organizations can better navigate the complex and fraught landscape of global supply chains in the digital age. 

Technology such as Interos Watchtower™ utilizes AI to continuously map and monitor relationships across the risk lifecycle to help enterprises mitigate physical and digital threats before they escalate to crisis. 

To learn more about how Interos can fortify your supply chain, contact us.  

 

 

Why AI Risk Intelligence Is Key to Strengthening Digital Supply Chain Cybersecurity

Posted on by interos.ai

Image: NOIRLab/NSF/AURA/T. Slovinský

Story by Alea Marks & Dianna ONeill

The second episode of Interos’s executive insights series, “Voices of Innovation,” explored how AI is enhancing digital supply chain cybersecurity – with former CISA Chief of Staff Kiersten E. Todt calling the issue an “urgent challenge.”

“The AI Revolution in Supply Chain Cyber Defense” discussion between Todt and Dave DeWalt, founder and CEO, NightDragon, comes against a backdrop of soaring software supply chain attacks that make today’s complex digital ecosystems acutely vulnerable to breaches, attacks, failures and other cascading disruptions.

Here are five key takeaways from their conversation:

1-Understanding and Managing Supply Chain Risk
The rise in software supply chain attacks has highlighted persistent and costly risks in interconnected digital supply chains, particularly as cybercriminals exploit vulnerabilities in third-party software components. Gartner projects that by 2025, 45% of global organizations will have experienced a supply chain attack, which is three times higher than in 2021

Todt stressed the need for visibility and transparency in managing latent third-party vulnerabilities:

“I do think it’s one of the most urgent challenges to be addressed because we don’t know all the interdependencies [that exist] and we have to have greater visibility into all of the touchpoints that we have. Understanding our third-party risk, understanding where third-party supplier vendors are not as strong or resilient as we need them to be, is critical.”

Recent data shows that 61% of businesses have been impacted by supply chain attacks in the past year, highlighting the extensive attack surface and the urgent need for proactive measures. AI-driven  intelligence – which has the power to continuously monitor supply chain lifecycle risk at scale – is vital amid these realities.

2- Government and Industry Partnership

The collaboration between government and industry has led to approaches like Secure by Design, which emphasizes integrating security measures into the development process from the beginning, rather than adding them later, and ensuring a careful balance between security and innovation:

“The prioritization of security over getting something out there is what needs to happen. Secure innovation doesn’t have to be an oxymoron,” Todt said.  “If we think about cybersecurity, progress is security, it is safety. That is the principle […] that we’ve seen from the government leaders, but importantly as partners with industry, that we’ve seen prioritized.”

3- Opportunity Over Sophistication

DeWalt noted the importance of identifying “choke points” in the supply chain, as demonstrated by third party cyber vendor incidents in companies like Change Healthcare and auto dealership software company CDK. Todt emphasized that risk is often about opportunity rather than sophistication:

“When you look at Colonial Pipeline, that company for all we know was not targeted because it was transferring 45 percent of fuel along the East coast, it was targeted because it didn’t use multifactor authentication and in a broad sweep its vulnerabilities percolated to the top. A lot of this activity is just looking for where the vulnerabilities are. It’s so important to appreciate not just where they are, but what do you need to function? What do you need to be efficient? What does your supply chain and your manufacturing process need to actually operate?”

Interos Watchtower™: The Necessary Visibility

DeWalt emphasized the complexity of global supply chains, where today’s large enterprises can easily maintain tens of thousands of suppliers across their extended global networks. Identifying and understanding supplier risk across these interdependent ecosystems is crucial, and new technology such as Interos Watchtower™ utilizes AI to continuously map and monitor relationships across the risk lifecycle to help enterprises mitigate supplier failures before they escalate to crisis.

By leveraging AI and real-time critical risk intelligence, companies can enhance their resilience against cyber, regulatory, ESG, and other threats, ensuring that their digital supply chains remain secure and efficient.

Enabling the Future with AI Supply Chain Intelligence

AI technologies are revolutionizing supply chain security by enabling advanced analytics and real-time risk detection, monitoring, and other advantages. These capabilities allow organizations to anticipate potential supply chain disruptions in advance to rapidly mitigate threats and optimize resource allocation.

To watch the replay of Todt and DeWalt’s conversation click HERE.

To learn more about how Interos can fortify your supply chain contact us HERE.

 

 

 

“It’s Going to Get Worse Before It Gets Better” Navigating Supply Chain Geopolitical Risks: Insights from National Security Experts

Posted on by interos.ai

by Alea Marks & Dianna ONeill

Interos’s new executive insights series, “Voices of Innovation,” hosted a critical conversation on escalating geopolitical threats to supply chain security.

The inaugural session brought together former NSA Director and US Cyber Command head, Admiral Mike Rogers (Ret.)  and Andrea Little Limbago, Ph.D., Head of Applied AI, Interos, and a frequent speaker on geopolitical risk and cybersecurity.

Five Key Quotes

1-Supply Chain Vulnerabilities

In an era of global interconnectedness, supply chains have become increasingly complex and efficient. However, this integration introduces acute new vulnerabilities. Today’s multinational ecosystems can easily encompass thousands of sub-tier suppliers, fueling continued supply chain disruptions that cost the global economy $3 trillion in annual losses.

Admiral Rogers highlighted this double-edge sword, noting the ripple effect across interconnected systems:

“There’s definitely been a tradeoff,” Rogers observed. “The downside is we have to acknowledge, as we can see with CrowdStrike being the latest issue, that we’ve got fundamental vulnerability inherent in the system.”

2-Geopolitics and Corporate Boards

Given the global footprint of many large enterprises, Admiral Rogers highlighted the growing concern among corporate boards regarding geopolitical risk:

“I spend a lot of time talking to corporate boards on geopolitics. They are trying to understand, the world around me seems to be changing. That has implications for my business model, and it has implications for my liability and responsibility.”

Rogers emphasized that companies are increasingly recognizing the need to better understand the global context and for their supply chain operations, identify risks, and develop strategies for risk mitigation and prioritization.

3-Criminals Targeting Supply Chains

In discussing evolving digital cyber threats, Admiral Rogers expressed surprise at the recent trend of criminals targeting digital supply chains:

“I never thought I would see criminals go into supply chain, supply chain route in terms of an attack vector. That was true until about 15 months ago, but we’re now seeing criminals going down this route. So, organizations now are routinely asking themselves, do I understand the dimensions of my supply chain? And what steps am I taking to try to mitigate that risk?”

4-Proactive Risk Mitigation

Anticipating and preparing for potential disruptions emerged as a critical theme. Rogers emphasized the value of proactive planning and regular practice in enhancing an organization’s resilience:

“The more time you put up front in thinking through and anticipating, the better your performance in crisis,” he advised. “I can’t anticipate every scenario, but the more I train, the more I simulate, the more I practice, the more efficient and effective I’ll be in responding to disruption and generating resilience.”

5-Evolving National Security Landscape

The conversation addressed the changing nature of national security, which now encompasses economic security and digital advantage. Rogers highlighted how this shift is leading to increased government involvement in previously private sector domains.

“Governments are getting much more directive and much more broadly involved,” Rogers observed. He noted a significant shift in cybersecurity strategy: “The biggest shifts in [cybersecurity] strategy were, number one, it’s no longer the individual user to hold accountable – it’s the entities that are in the best position to achieve a broad impact.”

Interos Watchtower™: A Strategic Solution

Rogers and Little Limbago also discussed Interos Watchtower™, AI-driven technology that provides personalized risk models to defend against geopolitical threats. Rogers noted the criticality of mapping and prioritizing threats, emphasizing:

“We have got to get to prioritization. Because if we can’t prioritize, if we can’t figure out the best use of limited resources, we got real problems.”

Watchtower highlights vulnerable suppliers based on potential business impact, allowing organizations to prioritize and remediate regulatory, cyber, government intervention, and foreign ownership risks, among others.

Looking Ahead

Admiral Rogers concluded with a sobering yet hopeful outlook:

“It’s going to get worse before it gets better.” However, he noted that more businesses and senior leaders are acknowledging the challenge, stating, “You can’t solve a problem if you don’t acknowledge it.”

The conversation made clear the pervasive nature of geopolitical supply chains impacts. From trade tensions to shifting nation-state alliances, a host of changing global dynamics present new opportunities for disruption. Organizations that fail to  adopt a proactive, technology-driven approach to these realities risk falling behind.

Technologies like Interos Watchtower™ are a significant advancement, offering the personalized, actionable intelligence necessary to enhance supply chain strength and security in a volatile  landscape.

Learn more HERE.

 

 

From Tesla’s Troubles to Industry Solutions: Addressing Child Labor in Global Supply Chains

Posted on by Dianna ONeill

Concerns about the potential for child labor in Tesla’s supply chain highlight a critical issue facing multinationals today: the challenge of ensuring ethical labor practices throughout complex global supply chains.

Despite CEO Elon Musk’s promises of third-party audits and webcams to monitor cobalt mines in the Democratic Republic of Congo, critics charge implementation is falling short.

The Ripple Effect: Industry-Wide Implications

This situation exemplifies the broader challenges companies face in addressing labor issues across their multi-tier supply chains. As governments worldwide implement stricter regulations, companies must act swiftly to protect their reputations and comply with evolving standards.

Interos data shows executives estimate that ESG-related cost increases or revenue losses impact companies at $44M annually.

At Interos, we’ve identified five key strategies to help organizations eliminate unethical supply chain labor practices:

  • Conduct Comprehensive Supply Chain Mapping: Gain visibility into the extended supply chain, from direct suppliers to nth-tier sub-suppliers, to identify vulnerabilities. Continuous supply chain lifecycle risk intelligence from Interos enables advanced analytics and real-time monitoring to scrutinize supply chains for regulatory violations and other ESG concerns.
  • Implement Robust Due Diligence Processes: Develop and enforce rigorous due diligence procedures to complement technology-based assessments. This means going beyond assessing suppliers’ labor practices through audits carried out by accredited third-party agency, to embracing deep supplier visibility and real-time risk assessments..
  • Leverage AI Predictive Analytics: Utilize cutting-edge technologies like Interos’ AI-powered platform, which evolve enterprises from lagging to leading indicators to drive proactive mitigation. Interos’ next generation ESG risk model monitors multiple critical attributes reflecting the multi-faceted nature of ESG threats, including forced labor, emissions, diversity, foreign ownership, and other critical attributes.
  • Collaborate with Industry Partners and Stakeholders: Engage with industry associations, non-governmental organizations, and government agencies to share best practices, align efforts, and collectively address forced labor challenges.
  • Promote Transparency and Accountability: Implement transparent reporting mechanisms, establish clear policies and codes of conduct, and hold suppliers accountable for violations through corrective action plans or termination of business relationships.

Case Studies: Accelerating Ethical Supply Chains with Interos

Interos survey data shows more than a third of leaders at large enterprises are stepping up their ESG investments, and over half acknowledged supply availability was paramount. Global organizations using Interos have gained a sharper picture of supply chain risks, enabling proactive strategies, yielding clear results:

  • A leading global airline leverages Interos’ supply chain lifecycle risk intelligence to ensure the highest standard of ethics and compliance across its apparel supply chain and other sourcing channels.
  • A supermajor oil and gas company leverage Interos to ensure adherence to 30+ EU regulations related to labor, emissions, and other areas.
  • A major retailer utilizes Interos’ foreign ownership data to determine, reduce and remove slave labor from its product lines.

Interos is leading a broader supply chain risk revolution towards transparency and ethical responsibility across industry, enhancing corporate brand, reputation, and profitability.

By taking proactive steps and leveraging the Interos platform, organizations can navigate the complexities of supply chain forced labor risk to foster ethical, responsible, and adaptable supply chains that meet, and surpass, the demands of today’s interconnected economy.