- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
When Indian enterprises ask where their biggest undiscovered attack surface lies, the honest answer today is not inside their own perimeter — it is in the sprawling ecosystem of vendors, integrators, cloud providers, and software libraries that touch their networks every day. Supply chain cyber risk has quietly become one of the most consequential categories of enterprise threat, yet most Indian security programmes still treat it as a procurement checklist rather than a live operational problem.
This post examines why third-party and supply chain risk deserves a seat at the board table in 2026, what the Indian regulatory landscape demands, and the concrete steps CISOs can take — right now — to bring this exposure under control.
The threat is structural. Modern enterprise IT is assembled, not built. A mid-sized Indian manufacturer might run an ERP from one vendor, an endpoint protection stack from another, SD-WAN appliances from a third, and dozens of SaaS tools alongside a hyperscaler cloud. Each of these relationships carries a trust assumption: the software and hardware have not been tampered with, the vendor’s own environment is secure, and updates delivered over the air have not been poisoned.
Recent global incidents have demonstrated how badly those assumptions can fail. The 2020 SolarWinds breach — in which a trusted network monitoring tool was used to deliver a backdoor to thousands of organisations — showed that even signed, vendor-sanctioned software updates can carry malicious payloads. The 2021 Kaseya VSA incident weaponised a remote management platform used by hundreds of managed service providers. In each case, attackers exploited trust relationships rather than fighting through perimeter controls.
India is not insulated from this pattern. CERT-In advisories have repeatedly flagged vulnerabilities in widely deployed enterprise products — routers, VPN gateways, server management interfaces — that Indian organisations were slow to patch because the update process itself was not treated as a security-critical workflow.
India’s regulatory environment is now explicit about vendor risk. The Digital Personal Data Protection (DPDP) Act, 2023 imposes obligations on “data fiduciaries” — that is, organisations that determine the purpose and means of processing personal data. Crucially, those obligations do not evaporate when processing is outsourced to a “data processor.” The fiduciary must, among other requirements, ensure that any contractual arrangement with a processor includes provisions requiring the processor to implement equivalent data protection measures.
In practice this means: if your payroll SaaS, your CRM, or your contact-centre BPO partner suffers a breach, you bear accountability for the personal data that was exposed. Demonstrating due diligence — including periodic vendor security assessments — is no longer optional.
CERT-In’s April 2022 directions (and the subsequent clarifications) reinforce this. The 6-hour incident reporting obligation applies to breaches regardless of whether they originate in your environment or in a vendor’s. If a supply chain compromise leads to data exfiltration from your infrastructure, you have six hours from discovery to notify CERT-In. Organisations that have not mapped their vendor dependencies cannot reliably discover such breaches promptly, let alone report them on time.
Understanding the attack surface requires mapping the layers where compromise can occur:
Open-source libraries, build pipelines, and software update mechanisms are all potential injection points. Dependency confusion attacks — where a malicious public package shadows a private internal package name — have been used in targeted intrusions. The Indian developer ecosystem, which relies heavily on npm, PyPI, and Maven repositories, is exposed to the same risks as any other.
Network appliances, servers, and IoT devices shipped with pre-installed firmware can carry backdoors or unpatched vulnerabilities before they are even racked. For Indian enterprises procuring hardware through grey-market or unauthorised channels, the risk is amplified significantly.
Ironically, the partners you engage to improve your security posture can also become an attack vector if their own environments are compromised. Attackers who gain access to an MSP’s remote management tooling can pivot into every client the MSP serves. Vetting your security partners’ own security practices is not paranoia — it is due diligence.
When an Indian enterprise stores customer records in a SaaS CRM or processes transactions through a payment gateway, the security of that data depends partly on controls the enterprise does not own. Shared responsibility models are not optional reading — they define where your liability begins.
Tackling supply chain risk does not require starting from scratch. A structured programme built around four disciplines — inventory, assessment, monitoring, and response — provides a defensible foundation.
You cannot manage what you have not catalogued. Start with a register that captures, for each vendor or software dependency: the data they access or process, the network segments they can reach, the criticality of the business process they support, and the contractual security obligations in place. This inventory needs to be a living document, not a one-time audit output.
Not every vendor deserves the same scrutiny. A tier-1 vendor with privileged network access and access to sensitive personal data warrants annual penetration testing results, SOC 2 Type II reports, and contractual rights to audit. A tier-3 SaaS tool used by three people in marketing may need only a standard questionnaire. The key is consistency within tiers, not uniformity across all vendors.
Third-party risk assessments should happen before a contract is signed, not six months after go-live. Standard frameworks — the Shared Assessments SIG, ISO 27001 supplier annexes, or NIST SP 800-161 for critical infrastructure — provide structured question sets. For high-risk vendors, supplement questionnaires with technical validation: review their most recent penetration test report, confirm patch currency on internet-facing systems, and check whether they appear in known data breach databases.
Static, point-in-time assessments are necessary but not sufficient. A vendor that was compliant in January can be compromised by March. Continuous monitoring — through threat intelligence feeds, attack surface scanning of vendors’ internet-facing assets, and dark web monitoring for credential exposure — provides the signals needed to catch deterioration between formal assessments.
Your incident response playbook must have a specific track for third-party breaches. Key questions to answer in advance: Who is the notification contact at each tier-1 vendor? What is your internal process for assessing the blast radius when a vendor reports a compromise? How do you meet the CERT-In 6-hour reporting clock when the breach originated outside your visibility? Tabletop exercises that include a “vendor breach” scenario will surface gaps before an incident forces the issue.
For organisations running Fortinet infrastructure — FortiGate NGFWs, FortiSwitch, FortiAP, FortiMail — supply chain hygiene starts with the platform itself. Fortinet’s firmware signature verification, FortiGuard threat intelligence subscriptions, and secure boot capabilities provide a foundation, but they require active management:
One of the hardest operational challenges in supply chain risk management is maintaining visibility across a fragmented estate — your own infrastructure, vendor-managed components, cloud workloads, and remote access channels — from a single operations view. This is exactly the problem that the PrahiX Ora platform is built to address, and it is the platform we deploy and operate for clients as PJ Networks.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. Here is how its four pillars apply directly to supply chain risk:
SIEM — Correlating Events Across Trust Boundaries: Ora’s SIEM ingests logs from across your environment — FortiGate, endpoint agents, cloud audit trails, and vendor-managed systems where log forwarding can be arranged — and runs correlation rules mapped to the MITRE ATT&CK framework. For supply chain scenarios, the most valuable detection patterns are those that catch lateral movement originating from a trusted integration point: a compromised MSP agent moving east-west, a poisoned update package executing with elevated privileges, or a vendor VPN session initiating unusual outbound connections. Ora’s graph-based attack storyline reconstruction links disparate events into a coherent kill-chain view rather than presenting analysts with a flood of unconnected alerts. This matters acutely for CERT-In compliance: Ora’s tiered log retention — hot, cold, and archive — supports the 180-day in-country log retention direction, ensuring you can reconstruct a supply chain incident timeline even if discovery is delayed.
NMS — Seeing the Full Estate: Supply chain attacks often succeed because defenders lack visibility into the segments where vendor-managed systems operate. Ora’s Network Management System provides unified observability across firewalls, switches, access points, and WAN/SD-WAN links, with LLDP/CDP topology discovery that automatically maps what is connected where. For organisations running multi-vendor estates — common in Indian enterprises that have grown through acquisition or run separate OT and IT networks — this single-pane visibility is transformative. ML-based anomaly detection flags when a vendor-segment device begins behaving outside its baseline: unusual traffic volumes, unexpected protocol usage, or new outbound destinations that do not match the vendor’s legitimate management traffic profile.
Video Surveillance (VMS) — Physical and Cyber in One View: Supply chain risk is not purely digital. Physical access — to data centres, server rooms, and network closets — is a real vector, particularly for hardware tampering. Ora’s video surveillance (VMS) module provides ONVIF/Hikvision/Dahua camera management with video analytics, allowing security operations to correlate physical access events with network activity in a single timeline. For manufacturing, retail, and multi-site enterprises where contractor and vendor staff routinely access physical infrastructure, this integration provides an audit trail that supports both security investigations and regulatory evidence requirements.
SOAR — Meeting the 6-Hour CERT-In Clock: When a supply chain compromise is detected, the response clock starts immediately. Ora’s SOAR module provides playbook automation with pre-built connectors and automated response actions, including the ability to push updated blocklists directly to FortiGate instances. For a third-party breach scenario, this means: the moment a compromised vendor IP or malicious domain is identified in threat intelligence, Ora can automatically push a block rule to your FortiGate estate before an analyst has completed the incident ticket. This kind of automation is not a nice-to-have — it is what makes CERT-In’s 6-hour reporting window achievable for teams that do not have round-the-clock analyst capacity. If you can contain and characterise the incident faster, you can report accurately and on time.
If your current SecOps tooling does not give you this level of integrated visibility across vendor boundaries, it is worth having a conversation about what a managed deployment of Ora would look like for your environment. PJ Networks can arrange a capability briefing.
Use this as a starting point for a board-ready supply chain risk programme:
PJ Networks provides managed security services to Indian enterprises across sectors — manufacturing, BFSI, healthcare, logistics, and retail. Our 24/7 NOC/SOC teams operate FortiGate infrastructure, deliver ZTNA rollouts, and run managed SIEM and monitoring through the PrahiX Ora platform.
If your organisation is looking to build or mature a third-party risk management programme — particularly one that meets DPDP Act and CERT-In requirements — our team can help with vendor risk framework design, FortiGate hardening for vendor access control, and ongoing managed monitoring of your vendor ecosystem. Reach out to discuss where your current programme has gaps and what a practical roadmap looks like.
Supply chain risk is not a theoretical concern for Indian enterprises in 2026 — it is an active, operational problem. The organisations that build systematic programmes now will be significantly better positioned when, not if, a vendor they depend on is compromised.