Colin Wiseman | Increased dependence on outsourced systems leaves businesses vulnerable

With cybersecurity now, a firm focus for company leaders, businesses have historically focused their cybersecurity efforts on protecting their own systems. Strong passwords, employee awareness training, multi-factor authentication and regular software updates are widely recognised as core components of a responsible cyber strategy.

But as cyber threats evolve, even businesses with strong internal controls can be exposed through the third parties on which they depend.

Instead, the next cyber incident could originate from one of the many third parties that companies rely on every day.

Increased dependence on outsourced systems leaves businesses vulnerable

From cloud storage providers and payroll platforms to accounting software, internet service providers and cybersecurity vendors themselves, organisations are increasingly dependent on outsourced service providers to keep operations running. While these partnerships have delivered efficiency and scale, they have also created a growing and often underestimated cyber risk.

Recent findings from IBM's Cost of a Data Breach Report 2026 show that supply chain compromise is now the second most common initial attack vector behind phishing, while supply chain-related breaches are among the most difficult incidents to identify and contain. The report found that these breaches take an average of 258 days to identify and resolve, and that business partner compromise is one of the largest contributors to increased breach costs.

This trend aligns with what Santam is seeing in the local market. South African businesses are becoming increasingly aware of cyber risks but many still underestimate the exposure created by third-party service providers. While phishing remains the leading cause of cyber incidents, outsourced service providers have emerged as a major concern for local insurers, particularly as more businesses move critical functions to cloud-based environments.

Like an offsite power outage, disruption elsewhere can stop your business

The challenge is that businesses often assume that if a trusted provider experiences an outage, breach or cyber incident, the responsibility rests with that provider. In practice, the operational, financial and reputational consequences can nevertheless cascade directly to the customer.

Importantly, third-party cyber risk does not take a single form. Data compromise risk arises when information held by a supplier is exposed, while operational dependency risk occurs when a supplier outage prevents a business from carrying out critical activities. System access risk arises where a supplier’s credentials or connection provide attackers with a route into the customer’s own environment. There is also concentration risk, where many organisations rely on the same cloud, software or technology provider and can therefore be affected by a single incident.

These risks can have immediate and wide-ranging consequences. A disruption at a cloud provider, payroll platform or software vendor can leave a business unable to process invoices, pay staff, communicate with customers or access critical systems. Even where customer or employee information is processed or stored by a third-party provider, organisations remain responsible for understanding and managing their obligations under the Protection of Personal Information Act, 2013 (POPIA), as well as other applicable legal, regulatory and contractual requirements.

In many ways, these incidents are becoming the cyber equivalent of a power outage. The disruption occurs elsewhere, but can bring your business to a halt.

Should businesses rethink outsourcing?

The risk introduced by third-party systems does not mean businesses should abandon outsourcing. Rather, it highlights the need for organisations to view cyber resilience more holistically.

Businesses should be asking tougher questions of their service providers. How is customer data protected? What security controls are in place? Are backups maintained? How quickly can services be restored after an incident? What contractual protections exist if something goes wrong?

It is also prudent for companies to identify which suppliers support their most critical processes, understand what data and systems those suppliers can access, and assess the operational impact if a key provider becomes unavailable. Contracts should address security responsibilities, incident notification, business continuity, data recovery and access to information following an incident. These measures should be supported by tested contingency plans rather than relying solely on the provider’s assurances

Many organisations assume cloud-based services are synonymous with resilience, yet they often lack independent backups or alternative systems should a provider experience a prolonged outage. As recent high-profile incidents around the world have shown, even large and trusted providers are not immune to disruption.

Third-party vulnerability compounds an increasingly complex threat environment

This growing risk is unfolding against the backdrop of an increasingly sophisticated threat landscape. IBM's research found that AI-driven attacks increased by 56% over the past year[i], while the global average cost of a data breach climbed to nearly US$5 million.

Attackers are no longer relying solely on poorly worded phishing emails. AI-powered impersonation, voice cloning, deepfakes and highly convincing social engineering tactics are lowering the barriers to attack and making it increasingly difficult for employees to distinguish legitimate communications from malicious ones.

As the complexity of the attacks evolves, businesses need a proactive partner

Despite increasing awareness of cyber risks, Santam's Insurance Barometer Report found that 42% of businesses still do not have specific cyber risk cover.

This suggests that many organisations continue to underestimate both the likelihood and potential impact of a cyber incident.

A common misconception is that cyber insurance simply covers the financial losses after a breach. In reality, modern cyber insurance is designed to support businesses through the entire lifecycle of an incident. Depending on the policy and cover selected, it can provide access to specialist incident response, forensic, legal, regulatory and communications support, as well as cover for certain business interruption losses.

*Colin Wiseman is Head of Cyber and Technology Risks at Santam Insurance.