Managing Third-Party Cybersecurity Risks in Digital Supply Chains

risk programmes typically assess and monitor direct (tier-1) suppliers and leave deeper tiers unexamined. This paper models a two-tier supplier network in which tier-2 compromises propagate to tier-1 suppliers and thence to the enterprise, and compares four monitoring regimes in 200 simulated years: no monitoring, tier-1 monitoring only, tier-1 plus partial tier-2, and full two-tier monitoring. Expected annual loss falls from 370 units with no monitoring to 239 with tier-1 monitoring, 176 with partial tier-2 coverage and 122 with full coverage; 95th-percentile loss falls from 640 to 311. Across regimes, between 64% and 82% of tier-1 incidents originate at tier-2, and the share rises when tier-1 alone is monitored, because direct compromises fall while propagated ones do not. The paper argues that supply-chain cyber risk is dominated by the tiers that programmes do not see, develops a tiered monitoring framework with coverage set by propagation exposure rather than by contractual proximity, and discusses contractual, technical and collaborative mechanisms for extending visibility beyond tier 1.