Eclypsium launches supply chain security guide to track risks and incidents

Digital supply chain security company Eclypsium has announced the launch of a new supply chain security guide to help IT, security, and procurement teams track risks and incidents. CIOs, CISOs, and supply chain leaders can use the guide to assess their exposure to supply chain cybersecurity threats and make better risk-based purchase decisions, the firm said in a press release.

At launch, the guide includes verified details about products and components of hardware and software vendors including Dell, HP, Lenovo, HPE, Cisco, Intel, and NVIDIA, as shown in the image below. It will be available as a standalone SaaS offering that is complementary to and integrated with the Eclypsium Supply Chain Security Platform.

Eclypsium

Supply chain security a top priority for organizations, security leaders

Supply chain security is a top priority for organizations and security leaders with several high-profile supply chain incidents affecting IT infrastructure in 2023. In March, it was revealed that the 3CX DesktopApp was compromised in a significant supply chain attack that saw a threat actor add an installer that communicated with command-and-control servers. In May, researchers detected suspected backdoor-like behavior within Gigabyte systems posing supply chain risks. In June, details emerged of a critical vulnerability (CVE-2023-34362) in a secure file transfer web application called MOVEit Transfer being exploited by hackers.

By 2025, 60% of supply chain risk management leaders plan to use cybersecurity risk as a significant determinant in conducting third-party transactions and business engagements, according to Gartner.

"Digital supply chain security is a board-level concern for many organizations, and there is an urgent need to provide a central repository for organizations to assess IT product risk," said Yuriy Bulygin, CEO and co-founder, Eclypsium.

Guide analyzes, verifies security of products to give CISOs more confidence

The Eclypsium guide will equip teams to track key supply chain risks/incidents and gauge if the products that they use or are considering purchasing are affected, according to the firm.

"Traditionally, CISOs assess vendor risk through questionnaires during the onboarding process - that's just paper. Then they have to manage that third-party risk in production - that's bits and bytes," commented Allan Alford, CISO at Eclypsium. Eclypsium's new guide brings hard, technical data to the vendor risk management process, analyzing and verifying products at a technical level so that CISOs can have more confidence when making decisions, he added.