Supply Chain Attack Surface Reduced by 80%

Engagement Overview

A European pharmaceutical manufacturer with operations in 12 countries needed an assessment of their supply chain security posture ahead of NIS2 compliance requirements.

Challenge

200+ third-party vendors with varying levels of access to internal systems. No standardised onboarding security review. Legacy flat network architecture with minimal segmentation between OT and IT systems.

Methodology

1. Vendor inventory — mapping all third-party connections and access levels
2. Attack path analysis — identifying lateral movement paths from vendor access to critical systems
3. OT/IT boundary assessment — testing segmentation between manufacturing systems and corporate network
4. Privileged access review — auditing VPN and jump host configurations

Findings

• Critical: 14 vendors with excessive persistent access — including 3 with no active contracts
• High: Direct routable path from vendor VPN to manufacturing SCADA systems
• High: Shared privileged credentials across 40+ vendor accounts
• Medium (×8): Unpatched jump hosts, weak VPN configurations, missing MFA

Outcome

Access revoked for 47 vendors. Network segmentation implemented isolating OT from IT with strict allow-list firewall rules. Zero-trust access model deployed for remaining vendor connections. Attack surface reduced by 80% as measured by reachable critical assets from vendor network.