As global supply chains are restructured in response to economic uncertainty, rising tariffs, and geopolitical pressure, a new cybersecurity dilemma is coming to the foreground. The number of cyberattacks exploiting supply chain vulnerabilities is surging. 45% of businesses are expected to face software supply chain attacks this year. With three major UK retailers falling victim to cyberattacks within just 10 days of each other, the need for rapid action is clearly emphasised.
To manage cost pressures, procurement complexity, and disruption risk, many businesses have spent the last few years consolidating suppliers. This means relying more heavily on a select few. But while this strategy may offer operational simplicity, it also introduces unforeseen cybersecurity risks.
When companies buy in bulk through a few key suppliers, it becomes harder to trace where individual components or services actually come from. The benefits of scale can quickly be outweighed by a lack of transparency. This creates openings for cyber threats – compromised hardware might be introduced without detection, unverified software and firmware can slip through, and oversight often breaks down across multiple layers of third-party subcontractor and vendor networks.
Recent geopolitical shifts in global trade have added a new layer of complexity, forcing companies to quickly move to new suppliers in different regions – often building entire supply chains from scratch. In this fast-changing environment, organisations must ask: are software-only cyber defences still enough?
Supply chain fragmentation is redefining risk
Over the past decade, cybersecurity strategy has largely focused on digital defences: intrusion detection systems, firewalls, endpoint protection, and role-based identity management. These are all essential, but they rest on the assumption that all components of an end-to-end system can be trusted or at least detected if they pose a threat.
As companies pivot to new vendors, particularly in critical infrastructure, telecommunications, and manufacturing, they inherit new digital dependencies often with little time or visibility to assess risk. A growing number of cyberattacks now originate, not from obvious threat actors, but from compromised supply chain components.
In a recent survey, it was found that 55% of global supply chain professionals use a mix of local and global IT solutions, resulting in fragmented systems that create multiple weak points for cybercriminals. These threats include routers shipped with hidden backdoors, firmware with embedded vulnerabilities, or software libraries poisoned long before deployment.
The infamous SolarWinds breach is a prime example where attackers injected malware into the company’s software build system for months before being detected. Because the malware was delivered through trusted channels, it didn’t appear as a breach to downstream customers – reinforcing the dangerous assumption that a well-known software supply chain couldn’t be compromised.
This is the challenge now facing every CIO and security lead. With the global supply web constantly shifting, the threat vector has moved upstream, and it’s becoming increasingly difficult to tell which components are compromised until it’s too late.
The blind spots in modern cybersecurity
Geopolitical pressures and economic instability have accelerated supplier diversification. As a result, organisations are often forced to onboard new hardware and software partners on compressed timelines. This leaves less room for thorough due diligence. The bigger challenge, however, is ensuring that pre-compromised components don’t make it through the door in the first place.
Modern cybersecurity tools excel at monitoring and responding to suspicious behaviour, but most still work reactively. If malicious code runs inside a network or access credentials are stolen, it’s up to the software to identify, isolate, and shut down the threat. This approach assumes detection happens quickly, before the attacker has had time to move deeper into the system.
Unfortunately, lateral movement – when attackers quietly expand their access across a network – is one of the most damaging and least understood stages of a cyberattack. Even a foothold in a non-critical system can lead to privilege escalation, data theft, and the compromise of sensitive environments. While software defences can slow this process, they often struggle to stop it entirely.
This is especially true in the case of state-sponsored attackers and advanced persistent threats (APTs), which use highly sophisticated methods and zero-day exploits that are designed to bypass detection or lie dormant until the right opportunity arises. If the initial breach comes from a trusted supply chain partner, it can slip under the radar for months hidden behind software that appears safe and behaves normally, until it’s too late.
Why physical isolation matters now
This is where physical network isolation enters the conversation. Not as a throwback to air-gapped systems of the past, but as a modern, strategic layer of defence. For years, organisations have used software-based methods like network segmentation and logical separation to compartmentalise systems. While valuable, these approaches are still vulnerable and can’t guarantee complete control. Physical connection control takes isolation further, enforcing a dynamic, hardware-based barrier – essentially a modern air-gap – that offers true separation and resilience against advanced threats and supply chain compromises.
At its core, physical network isolation does what software alone cannot. It completely severs the potential for any unauthorised communication. Systems can be placed entirely offline or connected only via out-of-band controls that are not susceptible to remote compromise. In other words, even if an attacker manages to breach a system or sneak in through a compromised component, they cannot pivot elsewhere because there’s simply nowhere to go.
In high-value environments, such as critical infrastructure, government networks, and financial systems, this approach is increasingly being revisited. The logic is simple: certain systems are too important to risk. They must be ringfenced, not just monitored.
Advances in control technologies now allow for dynamic physical disconnection. This enables systems to be securely reconnected for updates or access without maintaining constant exposure. It’s a modern interpretation of air-gapping, dynamic and perfectly adapted to today’s operational demands.
Resilient by design
A system that is physically unreachable provides a level of assurance that software-based defences alone cannot match. This makes physical isolation particularly valuable when built into supply chain security protocols. Systems receiving data or code from third-party vendors can remain physically segregated until fully verified, while backup infrastructure can stay completely offline until needed. Even control systems can be made unreachable from external networks, removing the risk of remote hijacking.
To be clear, physical isolation isn’t a silver bullet. But when it can be configured on demand, it becomes a critical layer in both threat mitigation and business continuity. It serves as a proactive first line of defence, a reactive last line of defence, and a practical way to limit the scope and timing of any potential attack.
In cybersecurity, layered defence is essential. Firewalls protect the perimeter, detection tools monitor activity, and identity systems control access. But if those are compromised, what’s left to protect the core?
Time to rethink what “secure” really means
As the digital and physical worlds become more intertwined, organisations must evolve their definition of cybersecurity. Only 30% of businesses report prioritising a secure, connected system for their supply chain. This indicates that more needs to be done. Software tools will always play a critical role, but they should not be the only line of defence. This is particularly true in an era where a single compromised component can trigger a cascade of consequences, all the way up to a network-wide breach.
Physical network isolation doesn’t replace modern cybersecurity, it reinforces it. In a future defined by volatility and hyperconnectivity, businesses must ask not just “can we detect threats?”. They also have to ask “can we better control them and contain them when detection fails?”
For those willing to embrace a multi-layered strategy that includes both virtual and physical controls, the answer will be yes.
