Advanced AI agents are redefining the future of business – one recent survey indicates as many as 68% of businesses expect to adopt the tech by the end of this year. But agentic AI could also pose an unprecedented risk to supply chain security, and even AI’s most prolific developers are sounding the alarm.
Anthropic’s next-generation Mythos model comes with an ominous disclaimer: once the model is available, cyberattacks could become far more advanced and difficult to counter. The existence of the model itself was revealed after a security breach leaked information, an ironic yet sobering reminder of hackers’ current capabilities – and how much stronger they could become with agentic AI.
The possibility of such intelligent cyberattacks has the world’s biggest organizations and governments on edge. However, the risk to them isn’t likely to start at home base; rather, the trouble starts with third-party vendors and suppliers, soft targets that act as ingresses to the whole supply chain. 30% of breaches happened through third parties in 2025, and without the right risk management infrastructure and strategy, that percentage is bound to grow.
To stay ahead of evolving threats, today’s enterprises must treat supplier risk management as a competitive strategy, rather than a box to check. This requires continuous vendor risk monitoring; accurate data – plus efficient ways to access and process that data; and strong coordination across the business to enable better decision-making and reduce time to action.
Managing Risk across Multi-Tier Supplier Networks
Organizations that rely on multi-tier suppliers already have additional risk management challenges. Lower-tier suppliers can expose them to a bevy of threats, from gaps in regional security oversight and regulation to weak cybersecurity practices. These smaller companies often don’t have the resources to properly safeguard their operations against emerging risks, especially not those as potent as the attacks that agentic AI could potentially carry out.
When these suppliers have access to their customers’ data, they put their entire customer network, plus anyone those customers do business with, at risk. An attack on a single Tier 3 or Tier 4 supplier can trickle all the way to major businesses and government entities. Add in agentic firepower, and the stakes get even higher. Unlike human hackers, AI agents can’t get tired or lose focus; they’ll just keep iterating, trying every potential method, relentlessly, until they break through.
Too frequently, procurement teams aren’t doing sufficient due diligence with Tiers 2-4. Not because they don’t think it’s important, but because they don’t have adequate operational support. To effectively assess risk, supply chain and procurement leaders require full visibility into every supplier and sub-supplier within their organization’s partner network. They need smarter mechanisms to keep track of the vast quantities of data required to conduct accurate assessments. They also need the ability to merge supplier data to track patterns across the full supplier network, from Tier 1 all the way down.
Fortunately, AI is incredibly effective at helping businesses address growing supply chain complexity. For one, AI allows for more precise pattern detection across the entire field of supply chain data, helping organizations to identify potential risks before they become the site of a breach. Risk can emerge across numerous touchpoints, from systems integrations to data access to operational controls. All of these processes require unique forms of monitoring, which AI can automate and run continuously, flagging potential threats in real time. These systems can then recommend actions, giving the right teams the insight they need to step in and solve the issue.
To maximize the advantages of AI, organizations need the right structural approach. Cross-functional teams with a shared mission of security will operate far more efficiently and effectively than teams working in silos and rarely sharing notes. Finance, procurement, and security teams should be aligned on their risk assessment priorities, with access to the same data and relevant insights. Risk shows up in various ways, from suspicious payments to unauthorized requests for data access, and teams uniquely attuned to these risks will be prepared to act faster. Not only that, they’ll have the insights and context to communicate urgency to the broader enterprise, making risk management truly cross-functional.
Multi-tier networks are critical to modern enterprise; companies cannot and should not forego these supply chain structures on the basis of cyber risk. The goal is to build resilience through intelligence.
Data Hygiene as a Defense Mechanism
Data quality underpins every stage of vendor and supplier risk management, from assessment to remediation.
Quarterly and monthly audits are no longer sufficient. Enterprises need continuous access to the most up-to-date insights about a current or potential supplier. This information ranges from their security posture and data handling protocols to new regulations and requirements that may impact them based on their region. However, they cannot always rely on suppliers to self-report. Therefore, enterprises must build cyber due diligence into the entire vendor lifecycle, making use of reporting and intelligence tools to capture the full portrait of a potential vendor’s security posture. Accurate, actionable data speeds up the risk assessment process, allowing teams to vet potential suppliers more efficiently, flag issues with existing partners, and quickly develop a remediation plan.
Beyond accuracy and quality, it also matters how third-party partner data is organized, accessed, and utilized across the organization. Data that exists in silos, without proper context and insights attached, isn’t going to help teams to root out potential risk. AI helps to convert raw supplier data into decisive action by synthesizing insights that are tailored to specific teams and functions, with visibility and application across operations to promote collaboration.
When Supply Chain Security Becomes Agent vs. Agent
Today’s enterprises are full steam ahead on their own agentic AI initiatives, many of which can help them to build supply chain resilience. AI agents can bolster cyber risk management by autonomously flagging potential issues, offering recommendations and executing fixes. They learn continuously, making them highly agile in the face of new vulnerabilities; through predictive threat modeling, agents could develop responses to threats before they even exist, and specialized agents can counteract the various stages of a cyberattack to cut off attackers before they can gain access to critical data. With human oversight and proper governance, agents can radically multiply an organization’s risk detection and remediation capabilities.
At the same time, by adopting agents, enterprises may be expanding their potential attack surface. AI agents require substantial computing infrastructure – far more than the typical chatbot – leading enterprises to expand their contracts with cloud providers and data centers. Like with any other supplier or vendor, infrastructure decisions must be made with a bias toward security and control, especially as agents must be trained on a business’s most sensitive data to automate critical functions.
As we move toward an agent-to-agent world, where autonomous bots are running key business processes, the best thing that enterprises can do is build a trusted supplier network and take aggressive measures to protect and maintain their data. Thorough initial assessments, continuous risk monitoring, improved end-to-end-visibility, and a strong vendor compliance program all work to improve an enterprise’s overall supply chain security posture. These measures will help to ensure that enemy agents can’t break through their defenses, while their own agents have the backing of a powerful dataset.
The Quantum Parallel
The cybersecurity risks posed by evolving agentic models mirror those of another emerging technology: quantum computing.
While quantum is not available yet, we’re within years of the threshold, meaning that businesses must prioritize quantum readiness across their operations. The encryption techniques that enterprises rely on to safeguard their most sensitive data could be completely denatured by quantum. Developing post-quantum cryptography is becoming an urgent business priority, rather than an experiment.
Attackers aren’t waiting for quantum’s debut, either. “Harvest now, decrypt later” tactics – where bad actors steal encrypted records and store them until quantum computing becomes advanced enough to enable decryption – are already in play. This risks exposing years worth of sensitive business records and personal information, impacting businesses across the entire supplier network.
Fortunately, the technologies and strategies that organizations employ to combat AI-powered cyber risk will also help to shield them against quantum decryption. With accurate supplier insights and a unified approach to risk mitigation, enterprises can circumvent harvest now, decrypt later tactics and bolster their quantum readiness. Eventually, quantum could also help to improve supply chain resilience down the line, assisting in everything from supplier selection to proactive security testing.
The Data Difference
It all goes back to data. From risk assessment to AI-enablement, having accurate, high-quality data on third-party suppliers, obtained through rigorous due diligence and continuous monitoring, is what will prepare enterprises for combatting risk in the agentic era.
Join our LinkedIn group Information Security Community!
