Supply Chain Characteristics as Predictors of Cyber Risk: A Machine-Learning Assessment

This paper provides the first large-scale data-driven analysis to evaluate the predictive power of digital supply chain attributes for assessing risk of cyberattack data breaches. Motivated by rapid increase in the complexity of digital supply chains and related third-party enabled cyberattacks, the paper provides the first quantitative empirical evidence that digital supply-chain attributes are significant predictors of enterprise cyber risk. The analysis leverages externally observable cybersecurity ratings that aim to capture the quality of the enterprise internal cybersecurity management, but augments these with original supply chain features that are inspired by observed third-party cyberattack scenarios, as well as concepts from network science research. The main quantitative result of the paper is to show that these supply chain network features add significant detection power to predicting enterprise cyber risk, relative to merely using enterprise-only attributes. In particular, compared to a base model that relies only on internal enterprise features, the supply chain network features improve the out-of-sample AUC by 2.3%. Given that a cyber data breach on a specific enterprise is a low probability high impact risk event, these improvements in the prediction power have significant value. Additionally, the model highlights several cybersecurity risk drivers related to third-party cyberattack and breach mechanisms and provides important insights as to what key metrics should be monitored and what interventions might be effective to mitigate these risks.