Resilience has become a board-level priority in today’s supply chain landscape. While much attention is rightly given to geopolitical disruption, climate change, and raw material shortages, one risk is still frequently overlooked: financial instability in the software supply chain. As digital operations increasingly rely on third-party platforms, supplier fragility – driven by unpredictable and unpreventable economic pressures – is becoming a critical vulnerability that must be addressed.

From logistics and inventory systems to order management and supplier portals, critical applications form the backbone of modern supply chains. Yet many of the applications powering these operations are developed and maintained by small, specialist vendors with business models that can be fragile and volatile. The threat of supplier failure, degradation of service, or sudden end-of-life decisions is growing, and it’s one that traditional risk assessments often miss. Startup failures rose by over 25% in 2024, with many enterprise SaaS providers among them. If you haven’t yet considered the threat of a supplier failure on your own operation and the disruption it may cause, you have a significant risk hiding in plain sight.

Why software vendor fragility matters

Unlike physical disruptions, which tend to be visible and simpler to quantify, financial instability can quietly accumulate in the background – and should it crystalise, present a severe but plausible risk. A missed software update, a key developer leaving, or a product line being quietly wound down can all trigger significant operational disruption. This type of risk is often difficult to detect until the effects are already being felt. There have been some very high-profile examples of this happening in recent times, the collapse of Sungard Availability Services being one such case. 

The worrying thing is that economic shocks in the software supply chain cannot always be stopped or sidestepped. Even large companies are not immune to service deterioration, particularly in the age of cloud and SaaS. These platforms are typically built for availability and security. However, they aren’t always designed to ensure business continuity for their clients. Ultimately, it is the responsibility of the end user to mitigate the risk of supplier failure. It’s the end user that needs to plan ahead, build protections, and maintain resilience. Even if the supplier can’t be. 

Adding further complexity is concentration risk. The frequent acquisition of smaller tech vendors by larger firms in a buoyant tech market often results in sudden changes to product focus, support levels, or platform continuity. These changes can reshape supply chain dependencies quickly, introducing risks that are difficult to anticipate. So, a complex picture begins to emerge. 

A gap in resilience thinking

Unfortunately, these are not theoretical concerns. Within finance, frameworks like DORA and PRA specifically highlight supplier fragility, service degradation and concentration risk as resilience issues. Now, if these are recognised risks in an industry known for its control and scrutiny, surely they must be just as significant (not to mention damaging) in other sectors where operational downtime affects fulfilment, reputation or customer trust.

However, continuity planning and procurement practices across many industries have yet to address these realities. The level of consideration to these risks across different sectors is varied at best – likely non-existent in some others. Too often, contracts do not establish controls such as access to source code or recovery rights if a supplier ceases operations. Many services were not developed with supplier failure in mind, leaving organisations to urgently rebuild essential functions – sometimes without the instructions.

In my work with regulated firms in financial services and their critical suppliers, I’ve seen how even seemingly stable suppliers can quietly exit the market. The warning signs are often small. They could be slower updates or reduced communication. But often, by the time it’s recognised as an issue, the impact is already being felt. This risk deserves greater attention in resilience planning.

Procurement: where third party risk management begins

These risks can be mitigated with action – best taken as early as possible. In an ideal world, resilience planning should start at onboarding, assuming critical supplier failure by default. Procurement has become a key function in safeguarding continuity. It ensures contracts include appropriate risk controls and embeds ‘resilience by design’ from the outset.

One widely adopted approach is software escrow. This involves securing access to the source code, documentation and development materials for essential software through a neutral third party. Should the supplier fail, or support be withdrawn, the organisation retains the ability to maintain the software independently. This practice is well-established in regulated industries across the world – with uptake increasing too.

Another crucial step is ensuring the ability to carry out ‘stressed exits’. This means organisations must include contractual rights and practical measures that allow them to exit key supplier relationships in a structured and low-risk way.

AI’s impact on vendor resilience

Looking ahead, the growing use of AI in software products may disrupt traditional software providers. Vendors with narrow offerings could find their business models undermined and may face financial pressures as a result. This creates a different kind of risk, one based on strategic viability rather than technical failure.

Organisations should regularly assess the financial health and future plans of their suppliers. As these pressures grow, the case for building resilience into supplier relationships becomes even stronger.

Software failures can stall a supply chain just as effectively as a logistics breakdown. Businesses that aim to maintain continuity must start considering these digital risks alongside more visible ones.

It’s an uncomfortable truth, but one we must accept. Vendor failure is no longer a rare event, so preparing for it is essential.

HSBC’s latest study on the impact of international trade disruption revealed that 75% of logistics firms expect to be impacted by tariff changes, which tells a familiar story. When uncertainty strikes, the industry’s instinct is to batten down the hatches – delay investments, cut costs, and hope the storm passes.

But whilst most operators are pulling back, the most forward-thinking logistics providers are doing the opposite. They’re recognising that trade disruption isn’t a temporary blip to weather. Rather, it’s a fundamental shift that demands a completely different approach to how logistics operations are structured.

The traditional model – owning expensive, dedicated truck fleets and managing isolated systems for capacity, compliance, payments, and data – made sense in a stable trade environment. When supply chains were predictable and trade routes were fixed, having your own assets provided control and certainty.

Today, that model has become a liability. When trade patterns shift weekly and 28% of firms are delaying investments due to uncertainty (according to HSBC), being locked into fixed assets limits rather than enhances your ability to respond. The logistics providers thriving through this disruption are those rethinking their entire operational architecture.

The power of connected systems in logistics

The real opportunity lies in connecting the traditionally isolated components of the logistics puzzle. When capacity sourcing, compliance management, payment processing, and performance analytics work as an integrated system rather than separate silos, businesses gain something far more valuable than asset ownership: operational agility.

Consider what happens when these systems talk to each other. Real-time capacity data informs instant pricing decisions. Automated compliance checks enable rapid onboarding of new carriers when trade routes suddenly shift. Integrated payment systems eliminate the cash flow delays that can cripple operations during volatile periods. Performance analytics provide the insights needed to adapt quickly to changing market conditions.

This integration transforms how logistics providers respond to disruption. Rather than being constrained by the capacity they own, they can access on-demand resources precisely when and where needed. Instead of lengthy manual processes for vetting new partners, automated compliance frameworks enable rapid network expansion. And waiting weeks for payment reconciliation is replaced by integrated settlement systems maintain healthy cash flows even during turbulent times.

Platforms like TEG exemplify this approach. They combine carrier sourcing, compliance management, real-time execution, and automated payment processing in a single integrated system. This allows businesses to pivot quickly between different capacity sources whilst maintaining full operational control and visibility.

Resilience through flexibility

The HSBC study found that 21% of logistics firms are already reconfiguring their supply chains to match global demand. Others are sharing services to spread risk. These are exactly the right instincts, but they require the right technological foundation to execute effectively.

Traditional, asset-heavy operations struggle with this kind of rapid reconfiguration. How do you pivot to new trade routes when your trucks are committed to existing contracts? How do you rapidly scale capacity when your fleet is fixed? And, how do you ensure compliance with new international partners when your processes are manual and time-consuming?

Technology-enabled operations face none of these constraints. They can source capacity from diverse networks, automatically ensure compliance across jurisdictions, and maintain real-time visibility regardless of how complex their operations become. When trade patterns shift, they shift with them.

The competitive advantage

What we’re witnessing isn’t just a response to current trade uncertainty – it’s the emergence of a fundamentally more competitive operating model. Whilst asset-heavy competitors struggle with fixed costs and limited flexibility, technology-integrated operations can offer better service levels at lower costs precisely because they’re not constrained by physical infrastructure.

The logistics providers making this transition aren’t just surviving the current disruption – they’re positioning themselves to thrive in whatever comes next. Because in an increasingly uncertain world, the ability to adapt quickly isn’t just an advantage – it’s essential for survival.

The question facing every logistics provider today isn’t whether to invest in more assets, but whether to invest in the technology integration that makes assets irrelevant.

The global supply chain is evolving into a smarter, more adaptive ecosystem, connected digitally, end-to-end. 

However, 45% of supply chain leaders report more frequent disruptions since 2020. Geopolitical tensions, like the Red Sea shipping crisis, have disrupted trade lanes and supplier networks. Climate events such as flooding in Southeast Asia and wildfires in Europe have impacted agricultural outputs and logistics hubs. Demand spikes and post-COVID consumption shifts caught many companies off guard, straining inventory systems.

On top of this, regulatory pressure is rising. Frameworks like the EU’s Corporate Sustainability Reporting Directive (CSRD) and the U.S. Uyghur Forced Labor Prevention Act (UFLPA) are forcing firms to increase transparency and rethink sourcing practices.

In response, organisations are completely rethinking their supply chain strategies by moving away from rigid planning and manual processes toward smarter, more adaptive systems that can sense change and respond in real-time.

Autonomous optimisation at scale

AI in supply chains is rapidly evolving from basic anomaly detection and dashboarding, to prescriptive and autonomous decision-making. Most organisations have achieved real-time visibility, but the competitive edge lies in how decisions are made and acted upon.

Companies are moving beyond basic data visualisation to implement AI systems capable of evaluating trade-offs, predicting disruptions, and recommending optimal responses in real-time.

Imagine a ride-hailing network navigating the chaos of a busy city. With AI-driven risk intelligence and real-time location data, the system spots patterns early, redirecting drivers to keep things on time and delivering insights that help teams perform better while keeping risks in check. Thus, the smartest systems are anticipating, adapting, and improving outcomes across the ecosystem.

A new sourcing paradigm

Geopolitical instability and trade shifts have dramatically altered the risk calculus and forced a reassessment of global sourcing strategies. While reshoring continues to make headlines, the real shift is more nuanced: the rise of regionally distributed, hybrid supply networks that strike a balance between efficiency and resilience. Think of it as designing a mesh-like supply chain that lets companies dynamically pivot between local and global sources based on real-time risk, cost, and market conditions.

Companies are moving beyond traditional cost-focused models, adopting a holistic approach that evaluates factors such as political stability, regulatory exposure, lead times, and sustainability. Businesses are adopting strategies that also weigh supply risk, sustainability, and market access – reflecting a more comprehensive risk management approach.

The focus now is on building supply networks that can flex with uncertainty by staying close to demand when it matters most, and bouncing back quickly when things go off track. That means localising where it’s smart to do so – and staying agile everywhere else.

From visibility to strategic simulation

Digital twins, virtual replicas of physical supply chain assets or operations, are no longer confined to engineering and factory floors. They’ve evolved into real-time simulation engines spanning the entire supply network. These tools now play a central role in prescriptive intelligence, enabling demand sensing, inventory management, and logistics optimisation.

For example, a logistics network might use a digital twin to simulate rerouting during a port shutdown, whilst a retailer could model inventory shifts in real-time during a seasonal demand spike. These simulations help companies ‘stress-test’ their supply chain strategies before taking real-world action.

The market for supply chain digital twins is projected to reach $5.98 billion by 2030, reflecting their expanding role in enabling predictive and prescriptive decision-making.

Optimising for ESG and economics

The old trade-off between going green and staying lean doesn’t hold up anymore. Today, forward-looking businesses are weaving sustainability into how they operate, right from sourcing materials to planning deliveries.

Carbon data is now being fed into procurement and production models, not just to report impact, but to actively shape smarter, lower-emission decisions. In fact, 74% of supply chain leaders expect profits to increase through 2025 as a result of applying circular economy principles.

Hence, sustainability is evolving from a compliance obligation into a true performance driver and, for many, a source of competitive advantage.

Breaking the silos

There’s no doubt that collaboration has become a performance multiplier. Organisations are increasingly partnering to share logistics infrastructure, supply capacity, and even real-time data and predictive intelligence. These collaborations are helping unlock synchronised planning and inventory precision, previously unattainable in siloed operations.

You could compare it to running a supply chain operation like a well-rehearsed routine where manufacturers and suppliers stay closely coordinated, producing only what’s needed, when it’s needed. 

However, partnerships don’t thrive on intention alone. From our experience, they work best when built on aligned data strategies, mutual accountability, and shared outcomes. Businesses should prioritise partners who can exchange operational data securely, support API-based integration, and co-own KPIs tied to real value.

It’s also worth considering that potential roadblocks like mismatched technology stacks, cultural misalignment, and unclear ownership can slow progress. The most successful collaborations are those that plan for these realities from the outset. Hence, such alliances go beyond cost savings by unlocking speed, precision, and resilience across the value chain.

People remain the edge

Technology is advancing rapidly, but people remain the true differentiator in supply chains. What’s changing is how they work. The most forward-thinking organisations are transforming traditional planners into ‘ecosystem architects’. These professionals blend operational expertise with digital fluency and strong data instincts.

Rather than replacing people, AI is becoming a trusted partner in decision-making. From copilots that support complex choices to embedded tools that guide everyday actions, intelligent systems are helping teams move faster and with more clarity.

The real advantage lies in how effectively organisations design and implement collaborative workflows between specialised human talent and intelligent automation. This will help amplify people’s judgement and creativity with intelligent systems.

As these shifts accelerate, the supply chains of tomorrow will be antifragile – built to flex, absorb shocks, and learn by turning disruption into momentum.

What will set the next wave of leaders apart isn’t their technology stack but how they weave intelligence, agility, and sustainability into everyday decisions, relationships, and roles across the supply chain.

In the contemporary digital era, supply chains have transcended their traditional role as mere logistical networks. They have evolved into pivotal ecosystems that underpin the success of modern businesses. Nevertheless, as these intricate systems undergo digital transformation, they have become increasingly vulnerable to cyberattacks. 

A vulnerable third-party vendor or contractor frequently serves as an entry point for breaches. This makes it a necessity to implement compliance and risk management measures. For businesses aiming to safeguard their operations, supply chain risk management is more than a regulatory mandate. It’s a critical countermeasure for protecting sensitive data, maintaining operations and ensuring trust.

Obrela’s third party risk management offerings

Obrela recognises the complexities that organisations face in managing third-party cyber security risks. Through its Managed Risk and Controls (MRC) offering, Obrela helps businesses meet stringent compliance mandates while ensuring a robust security posture. MRC is designed to evaluate, monitor and mitigate risks associated with third-party providers, ensuring compliance with industry regulations and frameworks, including the likes of NIS2, DORA, and ISO 27001.

The unique value of Obrela’s MRC lies in its ability to deliver a holistic approach. MRC Services offer an umbrella of solutions that enable clients to effectively manage and orchestrate various aspects of cybersecurity such as governance, risk, compliance, and operations. The comprehensive approach streamlines these diverse facets of cybersecurity, providing clients with a cohesive and integrated security solution.  In particular, MRC for Supply Chain, encompass the collection, analysis, and evaluation of information on security processes and practices currently in place, enabling a thorough assessment of compliance with selected contractual requirements and identification of areas that require remediation actions.

Given the dynamic nature of contemporary supply chains, it is imperative that businesses maintain constant vigilance. Contractors and third-party providers frequently handle sensitive data or access critical systems, necessitating businesses to ensure that these external entities adhere to stringent cybersecurity standards. 

Risk monitoring, assessment, and going beyond compliance 

Obrela’s MRC offering addresses this requirement through a comprehensive four-pronged approach. 

Firstly, continuous risk monitoring delivers real-time insights into the cybersecurity posture of third-party vendors. Monitoring key risk indicators ensures businesses can promptly address vulnerabilities as they emerge.

Next, comprehensive compliance assessments using automated tools and standardised frameworks allow the MRC solution to evaluate third-party providers against both regulatory and organisational requirements. This ensures vendors align with critical security policies and standards.

Thirdly, beyond compliance, MRC emphasises proactive measures to reduce risk. Identifying weak points within the supply chain enables businesses to implement targeted solutions before vulnerabilities are exploited.

Finally, MRC delivers detailed reporting and visual dashboards, providing organisations with a clear picture of their third-party risk landscape. This transparency supports informed decision-making and prioritisation of mitigation efforts.

Benefits of proactive compliance score and third-party risk assessment

Central to Obrela’s MRC approach is the concept of compliance assessment. This provides a quantifiable measure of a third-party vendor’s adherence to cybersecurity standards, helping businesses streamline vendor selection, for example. A compliance assessment enables organisations to evaluate potential vendors at a glance, ensuring only those with robust cybersecurity practices are onboarded.

Clear compliance benchmarks also facilitate smoother contract discussions, as expectations around security and data protection are established upfront. Meanwhile, knowing the compliance status of each vendor allows businesses to act swiftly in the event of a breach, minimising potential damage.

A proactive approach to compliance demonstrates due diligence, satisfying regulators and reducing the risk of penalties or legal issues. Finally, by regularly assessing and improving the compliance of their supply chain partners, businesses can create a more resilient and secure ecosystem.

Why proactive supply chain cybersecurity management matters

The growing integration of cloud services, IoT devices, and advanced technologies into supply chains only serves to amplify their vulnerability. Cybercriminals often exploit the weakest link, making proactive risk management crucial. Obrela’s MRC offering not only identifies these weak links but also strengthens them, creating a fortified supply chain that supports business continuity.

Supply chain compliance is no longer optional; it’s an operational necessity in an era of escalating cyber threats. Obrela’s Managed Risk and Controls offering empowers businesses to navigate this complex landscape by providing the tools, insights and strategies needed to safeguard their supply chains. With continuous monitoring, thorough assessments, and actionable compliance recommendations, Obrela helps organisations protect their operations, their data and their reputation.

Incorporating Obrela’s MRC into your cybersecurity framework ensures the integrity and resilience of organizations’ supply chains, by thoroughly examining security processes and practices. MRC for the Supply Chain provides organisations with the confidence to mitigate risks, safeguard sensitive information, and maintain uninterrupted operations.

It seems as though every new week (maybe even day) means a new, seismic change to the global economic order. The Trump administration’s tariffs have affected every import to the US. Many nations have responded in kind with their own tariffs designed to target President Trump’s electoral base. For example: the EU tariffs hitting US trucks, cigarettes, and ice cream last month. While all sectors are affected, some — including automakers and, most recently, the film industry — are faring worse than others. 

In response, companies with large, globalised supply chains are racing to relocate manufacturing and strike deals with new suppliers. Many are also trying to quickly move stock into US ahead of the next round of changes. In this unstable climate, inventory management has become an ever more pivotal aspect of managing the supply chain.  

To find out more, we caught up with Michel Spruijt, President at Brain Corp International. Brain Corp are a robotics and artificial intelligence (AI) company. Its solutions are helping logistics functions mitigate the pain points caused by an increasingly volatile supply chain landscape. 

Michel, how big of a challenge do inventory mismanagement and other supply chain inefficiencies pose for organisations today?

Inventory mismanagement and supply chain inefficiencies represent a significant challenge for European organisations. They have direct impacts on profitability, customer satisfaction, and operational resilience. Blind spots in supply chains can be extremely costly: research indicates that the average company could lose nearly half of one year’s profit over a decade from a single prolonged, severe disruption. 

Inefficiencies such as inaccurate inventory data, manual processes, and lack of real-time insights often result in lost revenue, overordering, waste, and missed sales opportunities. 

The scale of these problems is amplified by the complexity of modern supply chains. These systems can span continents and involve hundreds or thousands of suppliers. It makes visibility and control even tougher.

What’s causing these types of inefficiency and lack of visibility?

When we examine the European supply chain landscape, we’re witnessing several critical challenges that are holding companies back. First, there’s a significant technology shortfall. Many organisations are still operating on legacy systems that simply weren’t designed to handle the speed and complexity of today’s market disruptions.

Second, we’re facing what could be thought of as a talent crisis in logistics and manufacturing. The workforce is aging, recruitment isn’t keeping pace, and this labor shortage is creating real operational bottlenecks across the continent, according to the European Commission.

Third, supplier networks have become incredibly convoluted and opaque. Most businesses only have clear visibility into their internal contents, leaving them vulnerable to disruptions further upstream that can appear without warning.

“For the retail and supply chain sectors specifically, these tariffs represent a significant threat” — Michel Spruijt, President, Brain Corp International

Finally, despite all our technological advances, we’re still seeing an overreliance on manual processes for fundamental operations including inventory management. This not only introduces errors but also creates significant efficiency drags.

These factors combined are seriously impacting European businesses’ ability to maintain resilient, responsive supply chains in today’s volatile market conditions.

Do you see the ongoing uncertainty around Trump’s tariffs exacerbating these problems (not to mention their impact on businesses)?

For the retail and supply chain sectors specifically, these tariffs represent a significant threat. They’re impacting everything from product pricing to distribution networks, potentially compromising jobs, export competitiveness, and forcing many companies to fundamentally rethink their global sourcing and distribution strategies.

Perhaps most concerning from a business perspective is the broader uncertainty these policies create. It’s becoming increasingly difficult for retailers and supply chain operators to engage in effective long-term planning, make confident investment decisions, or maintain stable supplier relationships. This environment of uncertainty inevitably leads to inefficiencies and significant disruptions across the entire supply ecosystem.

The reality is that in today’s interconnected global marketplace, this level of trade policy volatility creates ripple effects that extend far beyond immediate tariff costs.

How does a business with a global supply chain consistently get their hands on real-time, accurate data?

We’re seeing a multi-layered approach – comprising new technology and a new attitude – that’s delivering results for forward-thinking organisations.

First off, there’s a shift toward IoT and Sensor deployment across the entire supply ecosystem. These technologies when deployed within intelligent solutions can offer continuous, granular visibility into inventories that simply wasn’t possible before. Equally critical is the move toward centralised, cloud-based data platforms, that are breaking down traditional information silos and creating a single source of truth that’s accessible across boundaries.

The real game-changer, though, is how we’re applying AI and advanced analytics to this data ecosystem. These tools aren’t just monitoring information—they’re identifying patterns, flagging anomalies, and generating insights that allow managers to address potential difficulties proactively rather than reactively.

We’re also seeing tremendous impact from automated robotics solutions like our own Inventory Scan technology that’s being used in global warehouses and logistics facilities. These solutions are capturing near real-time inventory data without adding operational headaches. This dramatically reduces dependence on error-prone manual processes while significantly boosting data quality and timeliness.

Where do robots and AI fit into this picture?

Robotics and AI are among the solutions leading the charge to transform supply chains. AI-powered robots, particularly those that collect inventory information, autonomously collect critical data on pricing, planogram compliance, and product location—freeing staff for customer engagement while reducing human error. These systems tackle both labor shortages and cost woes by consistently and accurately handling routine tasks.

What’s powerful is how this robotics-collected data feeds AI analytics, that can in turn improve decisions across operations, from maintenance to forecasting. Most importantly, when used in a well arranged stack, this technology dramatically enhances supply chain resilience, enabling faster disruption response and smarter resource allocation.

This robotics-AI–management convergence represents the future of intelligent supply chains, already delivering measurable advantages for early adopters.

Do you have any examples of retailers successfully navigating their way past these pain points?

European retailers are implementing inventory scanning technology with autonomous robots to automate inventory management. 

An example would be Sam’s Club in the US deploying Brain Corp-powered robots, which scan aisle inventories whilst cleaning. Benefits include faster data collection, freed staff time for customer service, reduced human error, and better responsiveness to demand changes. 

A recent study from ECR Community Shrinkage looking at seven European retailers found that correcting inventory discrepancies led to 4–8% sales growth, with the largest gains in high-volume and high-value items. For a typical European grocery retailer with €10 billion in sales, resolving inaccuracies could recover €0.4–0.8 billion in sales. 

Personally, and professionally, the impact of recent US government policy around trade and tariffs is felt by all of us. From a business perspective, tariffs represent a major concern for companies looking at corporate goals and metrics in both the short and long-term. It has now become unclear exactly what the cost of doing business will be, and how consumer demand may shift, based upon personal preferences and spending ability.

But this is not really uncharted territory. Over the last decade, the world has faced many disruptive events: Brexit, COVID, the Suez Canal, geo-political conflicts, climate changes, and so on. Each one is unique in its nature, but they all have similar impacts on supply chains and manufacturing; causing breaks in global supply, extreme fluctuations in demand, and unknown costs and barriers to competing.

Tariffs & Twins – The critical connection between disruption, AI and virtual twins

The need to react to unexpected global disruption is now a fundamental requirement for all companies; tariffs are only the latest incarnation of what manufacturers have to deal with. In each case, business leaders in supply chain and manufacturing are forced to face with the same basic questions:

1. What is the impact of the disruption?
2. What should I do now?
3. What can I do to prepare for the future?

Prior to globalisation of trade and the increase in product and supply chain complexity, the first two questions were difficult, but not impossible to solve. Because of that, organisations largely ignored or deprioritised the third question. Today (with COVID being the pivot point in my opinion), all three questions have become a) critical and b) impossible to answer without the help of technology.

This is where Virtual Twins and AI capabilities have become essential to helping companies become agile and resilient to disruption. Let’s look at how they help with each of the basic questions:

What is the impact of the disruption?

This was the biggest (certainly the first) question from companies at the start of COVID, and led to much analysis and investment in the “control tower” concept. A control tower is only part of the solution though. What people were actually asking for was a precise digital representation of the entire supply chain with end-to-end and top-to-bottom detail and real-time operational status of facilities, resources and products – also known as the Virtual Twin.

With tariffs, the virtual twin acts as a source of truth that enables companies to see the current state of production and fulfillment, the source of all materials, and the process by which inventory and products are moved across borders before reaching customers. Additionally, it allows companies to immediately identify vulnerable points of supply, new costs, and opportunities to leverage existing contingencies based upon real-time availability and capabilities.

What should I do now?

Even with a precision virtual twin, the complexity of global supply chains and the number of possible business permutations are beyond human comprehension to evaluate and analyse effectively. However, traditional AI methods (such as optimisation) are now adept and considering competing business priorities to balance supply and demand while considering any number of physical and logical constraints. Used along with the virtual twin model, manufacturing and supply chain leaders can use AI to experience unlimited what-if scenarios to determine tactical responses.

Tariffs don’t represent a physical constraint, but cost is a major driving factor in the optimisation of the supply chain and production plans. Experimentation also allows companies to play games with the possible limits. For example, at what tariff percentage might we be able to absorb costs to protect margin without having to pass all the costs along to the consumer and impacting demand? These are logical questions that are extraordinarily difficult to answer without technology.

What can I do to prepare for the future?

One of the stated goals of recent policy is to bring manufacturing back to the United States, essentially on-shoring production that has developed in areas previously seen as economically more cost-effective. Without debating the policy, let’s look at the basic decision process to evaluate strategic changes to mitigate the impact of tariffs on production locations:

1. What is the increase in operational costs most likely to be based upon movement of inventory and products?
2. What would the reduction in operational costs assuming similar production capabilities in the US?
3. What capital investment do I need in order to expand or build new manufacturing capacity?

The virtual twin of the supply chain will help us answer questions a) and b) by applying AI to the existing model of the enterprise and a variety of what-if models that supply chain teams can quickly create. Question c) requires a virtual twin model of production systems, so that we can accurately evaluate what our new or changed facilities and manufacturing process should look like. These virtual twins need to work in orchestration so that we can ensure confidence in what is likely to be billion-dollar decisions.

The precision of the virtual twins is so important because there are so many factors to consider. For example, it’s unclear whether there will be enough skilled workers to support a resurgence in manufacturing. Therefore, organisations need to consider robotics and automation as part of the manufacturing process. The smallest of details can have such a major impact on the final result.

Preparing for the future

There are also other ways to address the challenges in the short and mid-term. One strategy might be rapidly re-designing products to reduce the reliance upon supply and parts that need multiple border crossings, another great leverage of the virtual twin and what-if simulation.Of course, the best course of action to be prepared for the future, is to consider virtual twin technology today, if you have not done so already. Ironically, today’s uncertainty will undoubtedly be the biggest barrier to making an investment in digital transformation as budgets become frozen pending a more confident outlook. The challenge though, is that the next disruption is right around the corner, and from another unexpected direction. There is rarely a “best time” to wait for, but there is never a “wrong time” to make a start.

On May 12, 2021, US Executive Order (EO) 14028 made software bills of materials (SBOMs) part of every open source risk management and software supply chain security conversation. The EO didn’t define any requirements surrounding SBOMs. However, it did ignite relevant efforts for software producers and consumers across the globe. 

Since the issuing of the EO, we have seen some clarification around SBOM requirements. These include those outlined by NIST, but requirements vary across different industries, jurisdictions, and private customers. Regardless, it’s important for software producers and consumers to understand the limitations of SBOMs across the board. Doing so will help them understand how to best augment their SBOM workflows to account for those limitations. 

SBOM limitations: It’s just a list of ingredients

Just like any data source, the effectiveness of an SBOM is dictated by its accuracy. If an SBOM doesn’t accurately list its components and their effective versions, then there is a chance of unaccounted risk. However, establishing complete visibility of application dependencies is harder than ever. 

The 2025 Open Source Security and Risk Analysis (OSSRA) Report by Black Duck found that 70% of open source dependencies in the average commercial application are transitive. Also, only 77% of all open source dependencies can be identified by scanning package manager manifests. This means that nearly one quarter of all open source dependencies in commercial applications are introduced though other means. These include manual inclusion, AI coding assistants, non-standard package managers, and so on. Identifying all these dependencies for inclusion in an SBOM is growing increasingly difficult, emphasizing the concern of inaccurate SBOMs. 

Should teams overcome the challenge of SBOM inaccuracy, then comes the task of identifying risk. Essentially, an SBOM is just a list of ingredients. It does not provide any insights into potential risk associated with the listed dependencies. For example, an SBOM could mention the inclusion of Apache 2.12.2. However, it will not tell you that component contains a critical vulnerability that has been exploited in the wild. All the SBOM generation and ingestion efforts made by teams will be for naut should they be unable to associate SBOM components with risk. 

SBOMs Under Threat 

Adding to the complexity is that SBOMs themselves can become targets of attack. Just like attackers can compromise a software artifact in the build or deployment stage, just as they did with SolarWinds and Codecov, respectively, they can do the same with SBOMs. Should an attacker gain access to a build environment to inject malicious packages, it wouldn’t be a far leap for them to also intercept a legitimate SBOM to remove references to the malicious package before sending it along to their unsuspecting victims. If this is done early enough in the software development lifecycle, the producer may even sign the corrupted SBOM, verifying its authenticity. 

These examples of challenges and limitations represent a few among several others, like lack of standardization and compatibility, difficulty keeping SBOMs dynamic and updated, overcoming limited visibility of dependencies, and so on.  All of this leads to perhaps the biggest issue, which is the overhead that this introduced to a business. Companies building software in regulated spaces have no choice but to build SBOMs and grapple with these challenges, meaning that more resources must be onboarded or shifted towards solving these problems. 

Using automation to shift SBOMs from liabilities to assets

Considering that the average application contains 911 open source dependencies, manually identifying and tracking these dependencies is not a scalable approach. Leveraging the use of a tool, like software composition analysis (SCA), automates this task, among others, to bring accuracy alongside velocity. 

Depending on the quality of the tool, SCA can automatically detect open source, commercial, and custom components before, during, and after builds. Additionally, some can import third-party SBOMs and automatically add the listed dependencies to the consumer’s own projects. The result is a complete and accurate SBOM, ideally exported in a standardized format like SPDX or CycloneDX. 

Given the pace of modern application development, SBOM generation isn’t something that should be done on a pre-determined basis. Some studies suggest that even the slowest DevOps shops have an average cycle time of less than a week. As soon as a change is committed to a project, an SBOM is out of date. For this reason, building dependency analysis and SBOM generation directly into the software development lifecycle is crucial. This includes triggering scans and SBOM generation via integrations with CI/CD tools like GitHub, Jenkins, or Artifactory. Doing so prevents SBOMs from being static and chronically outdated. 

Connecting the Dots

These same tools and integrations can be used to connect the dots between SBOMs and associated risk. An SCA tool will include a database of known vulnerabilities. This will alert teams to vulnerable components that violate custom policy. This will prevent them from getting built into projects and making it into the final SBOM. 

Some solutions will even continuously monitor SBOMs long after the application has been shipped, evaluating them for newly disclosed dependencies that impact included dependencies. As a matter of fact, some software consumers require vulnerability information be included alongside SBOMs, perhaps in Vulnerability Exploitability Exchange (VEX) format, which many tools also offer support for. 

Finally, SBOMs need to be treated like any other software artifact when it comes to secure sharing. There’s no shortage of free and commercial solutions available offering secure APIs and storage for public and private SBOM distribution. This enables teams to leverage automation to detect application dependencies, continuously analyze them for risk, dynamically build SBOMs at the pace of development, and make them securely accessible to key stakeholders via APIs or direct CI/CD integrations. 

SBOMs: Another powerful tool to combat cyber risk

SBOMs enhance software security by improving vulnerability detection, compliance, and supply chain transparency. 

They help identify risks like Log4j and manage dependencies, but they have limitations. SBOMs can be incomplete or outdated, lack exploitability context, face standardization challenges, and introduce business friction. To be fully effective, SBOMs must be paired with real-time monitoring, vulnerability management, and secure distribution. These are all challenges that teams should turn to automation to address.

In our modern hyper-connected digital economy, it is not unusual for supply chains to extend ever further, becoming increasingly complex. Each supplier ecosystem can consist of organisations of any size, from sole traders on the high street to global enterprises, each of whom will have a different level of cybersecurity.

That means there might be insufficient protection, blind spots and an inability to respond effectively. It only takes one vulnerability within this chain to expose all entities within to danger because bad actors can daisy-chain quickly from the initial breach to other connected corporate networks, wreaking havoc along the way.

However, despite this clear risk, businesses in the UK are shockingly complacent about their supply chain security. Worryingly, the government’s 2023 Security Breaches Survey indicates that only just over a quarter of medium-sized companies monitor the cybersecurity risks posed by direct suppliers, with this rising to just over half when looking at large companies. Perhaps more alarming, it is even rarer for businesses to review the potential dangers from their extended supply chains – fourth parties and beyond – exposing many UK organisations to great risk.

Introducing the Digital Operational Resilience Act (DORA)

The EU is taking a bold stance on these supply chain risks, especially when it comes to finance and critical infrastructure. DORA outlines how financial institutions must take responsibility for operational resilience, defending against cybercriminals and enabling service continuity. It highlights the requirement to manage security risks related to third party suppliers, asking companies to assess, monitor and review their partners’ security protocols.

DORA makes the penalties for non-compliance clear: if a financial institution suffers a breach due to not following best practice, considerable fines will apply. In some cases, these will not apply to just the business, but senior executives could also be on the hook for repercussions, including criminal charges.

Shaping supply chain strategies

DORA acts as a resource to assist businesses to shape their supply chain strategies and influence related security policies. It is not the only regulation in this environment: the Network and Information Systems Directive 2 (NIS2) centres on critical infrastructure resilience, hoping to make the cybersecurity processes of essential service operators more robust. We can also look to the long-established GDPR, which sets the standard for the privacy and integrity of personal data as well as the rights of data subjects. Beyond the regulatory scope of the EU, there are independent entities linked to specific industries, such as the Payment Card Industry Data Security Standard (PCI DSS 4.0), which establishes security protocols for managing card payment details to keep personal data safe while preventing fraud.

Together, these security regulations aim to promote cybersecurity best practices across sectors and countries. They advocate collective responsibility, which is key to enhancing the security of complex supply chains where companies might operate as both customer and supplier. By supporting a collective approach to individual defence, all entities will benefit from faster threat detection, allowing improved incident response and mitigation. Sharing resources and processes is particularly useful for smaller organisations who might have fewer IT resources and smaller budgets.

Establishing collective defence

There are a number of prerequisites to consider before beginning your collective defence journey. It needs clearly defined policies within a legal framework to ensure sensitive data and the interests of each entity are protected. From the outset, trust between these entities is critical to securing agreement and eventual success.

Next, it is time to assess current defence systems and identify any gaps. Solutions must work with the existing IT infrastructure and security tools, although it is also important to update and standardise security protocols and applications, while leveraging APIs to seamlessly connect all participants.

Sharing skills and responsibilities will promote long-term, sustainable partnerships across and between each entity. For example, security teams can add specialist knowledge around SOAR (Security Orchestration, Automation, and Response) and associated automated tools. These streamline security operations, minimise alert fatigue and speed up threat mitigation. Moreover, collaboration of this type fosters learning within a community of executives with the same goals who can share the burden and support each other in the face of new threats.

To keep up to date with the ever-changing threat landscape, the collective strategy must comprise regular reviews and testing: adaptability is key to defence optimisation.

Protecting the vulnerable

Business resilience and continuity depends on supply chain security and compliance. Using guidance from regulations, such as DORA and NIS2, will standardise supply chain strategies, providing a foundation for a collective approach. This guarantees a more resilient partner ecosystem for everyone.

The final step is for companies to create their own information sharing networks using off-the-shelf solutions. This will keep their own operations secure while extending the protection to extended supply partners. Such engagement will supercharge threat intelligence sharing, enabling real-time cross-sector collaboration. Even the smallest sole trader could avail themselves of the early warning of looming danger to protect themselves – and others. At the end of the day, even the biggest enterprise’s defences are only as strong as its most vulnerable supplier.

In an ever-changing economy, supply chain management is essential for Facilities Management companies (FMs). The 2024 TrueCommerce UK Supply Chain Trends Report highlighted pressing concerns, like talent shortages, cost control, and new business. Limited budgets, insufficient staff training, and over-reliance on digital platforms exacerbate challenges within the FM industry. Compounding these pressures are global disruptions—from the lingering impacts of COVID-19 and Brexit to geopolitical conflicts—which exacerbate longstanding inefficiencies in supply chains. Smaller suppliers often struggle to meet the dynamic demands of larger organisations, lacking the infrastructure to adapt effectively. However, with a shift in perspective and approach, FMs can build resilient and efficient supply chains to weather these challenges.

Shifting scale

The traditional preference for partnering with large suppliers may not always yield the best results. Smaller, agile suppliers often provide more flexible and responsive services. Rather than focusing solely on size, FM companies should prioritise alignment with businesses that share common goals and values.

Clear communication and regular collaboration are essential. Establishing combined objectives ensures that all parties are working towards the same outcomes. Scheduled feedback meetings, coupled with the use of automated performance dashboards, can help track key performance indicators (KPIs) and maintain accountability. A communicative approach fosters stronger relationships, reduces misunderstandings, and promotes consistent service delivery.

Managing multiple suppliers

Coordinating multiple suppliers can be a headache, bringing different organisational cultures, variability in service levels, costs, and approaches to compliance and sustainability into the mix. Without standardisation, projects risk inefficiencies, errors, and compliance gaps, all of which can negatively impact reputations and bottom lines. Implementing standard operating procedures (SOPs) and leveraging automated technologies can address these issues effectively.

Integrated digital platforms streamline workflows and ensure transparency across the supply chain. For example, standardised protocols can minimise discrepancies in material costs or regulatory compliance. Moreover, the adoption of collaborative tools allows FM teams to monitor performance in real-time, creating a culture of shared accountability and continuous improvement.

Embracing digital transformation

Despite the rapid digitisation of other industries, FM has often been hesitant to let go of traditional paper-based systems and spreadsheets. However, digital workflow management platforms can revolutionise supply chain operations. These tools enhance not only the supply chain, but other elements of building operations as well.

It is crucial, however, to assess existing supply chain challenges before investing in new technologies. A tailored, user-friendly platform built on open workflows can deliver significant returns. DMA Group’s Service management platform, called BiO®, exemplifies how automation can enhance supply chain visibility, track supplier performance, and expedite tasks such as certification and payments. By eliminating manual processes, FM organisations can reduce delays, improve transparency, and build trust with their partners.

Automation and analytics

End-to-end automation offers transformative benefits for the FM industry. By engaging the entire supply chain, automated platforms provide actionable insights and analytics, enabling organisations to identify inefficiencies and make data-driven decisions. The ability to generate detailed reports not only highlights areas for improvement but also recognises exemplary performance.

For instance, automated workflows in platforms like BiO® enable real-time tracking of work allocation and supplier performance. By centralising information, FM companies can standardise practices and foster leaner operations. This transparency strengthens supplier relationships and contributes to healthier profit margins.

Building Resilient Supply Chains

To thrive in today’s FM, organisations must adopt a forward-thinking approach to supply chain management. By prioritising collaboration and leveraging technology, FM companies can create robust and adaptable supply chains. Such strategies not only mitigate risks but also drive long-term success, ensuring that every link in the chain contributes to seamless service delivery.

In the ever-changing world of facilities management, resilience and innovation are key. With the right strategies in place, supply chains can drive efficiency, sustainability, and customer satisfaction in equal measure.

Today’s vast and interconnected global supply chain is perilously vulnerable to cyber threats. In fact, the World Economic Forum (WEF)’s recent Global Cybersecurity Outlook 2025 found that 54% of large organisations cite supply chain security as the biggest barrier to achieving cyber resilience.

Disruptive cyberattacks such as ransomware can have significant and widespread issues on both upstream and downstream supply chains through mounting production and distribution delays. 

Manufacturing and other heavy industry sectors are particularly vulnerable due to their reliance on cyber-physical systems governed by Operational Technology (OT). The convergence of OT and traditional IT has blurred the once-clear boundary between digital infrastructure and physical operations, introducing new cybersecurity risks organisations can no longer ignore.

Cyber threat groups increasingly exploit complex supply chains to hit their targets. Therefore, securing the interconnected systems that power them is a business-critical priority, not just a technical concern.

The rising risks of IT/OT convergence in supply chains 

Supply chains have become increasingly digitised and interconnected, with IT and OT networks now deeply integrated across manufacturing, logistics, and distribution. This shift obviously improves efficiency. However, it also exposes critical infrastructure to cyber threats previously only threatened IT systems.

Historically, OT control systems such as supervisory control and data acquisition (SCADA) and programmable logic controllers (PLCs) have existed as a separate environment to traditional IT networks. As such, many of these systems were never designed with cybersecurity in mind and were built for purely physical threats. 

Now, a raft of digitisation efforts including cloud-based inventory management, remote monitoring, and smart automation have connected OT to IT systems. This has spurred the side effect of expanding the attack surface and creating new opportunities for cybercriminals to disrupt assets that were previously safely air gapped. Instead, they can breach IT networks and pivot into OT systems, disrupting production, logistics, and the delivery of essential goods.

This supply chain vulnerability is a growing concern. The 2021 SolarWinds attack and the Colonial Pipeline ransomware breach are two of the most high-profile examples of how cyber incidents can cripple entire industries by targeting suppliers or critical infrastructure. 

More recently, the 2024 global IT outage, triggered by a faulty software update in CrowdStrike, disrupted airlines, banks, and government services worldwide, underscoring the interdependent nature of modern supply chains.

Mitigating these risks means prioritising supply chain security as a core part of the cyber strategy. Without real-time visibility, proactive risk management, and clear accountability, supply chain disruptions will remain an escalating threat.

Why visibility is the foundation of effective supply chain security 

One of the biggest challenges in securing supply chains is the lack of visibility across interconnected systems and suppliers. Many organisations have limited insight into their suppliers’ security postures, let alone the vendors and subcontractors further down the chain. This creates blind spots, where cyber risks can go undetected until a breach occurs. Threat actors will frequently target smaller and less well-defended companies in the supply chain. These companies then serve as entry points to their larger customers or partners. 

The WEF report found that 41% of security leaders believe improving third-party visibility is their top priority. Enforcing security compliance among suppliers was also cited as a critical challenge. 

Yet many businesses still struggle with fragmented security monitoring and inconsistent enforcement of security policies across their supplier networks. Without comprehensive oversight, threat actors can exploit weak links in chains. These include vulnerable software updates, compromised remote access credentials, or unpatched OT systems.

To reduce risk, businesses must implement a layered approach to visibility. This mustinclude comprehensive asset discovery with the mapping of all IT and OT assets within the supply chain. The goal is to understand their interdependencies and highlight weaknesses and potential attack paths. 

Cyber-physical assets present an additional challenge here. Typically, OT systems are usually not compatible with standard cybersecurity tools for vulnerability scanning and threat detection. As such, IT teams need specialist tools to gain complete visibility into OT environments. 

Overcoming budgetary constraints and boardroom misconceptions 

Despite the growing risks, many organisations still fail to allocate adequate resources to OT and supply chain security. This is often due to a lack of awareness at the board level, where leaders often view cybersecurity as a necessary expense rather than a business enabler.

It’s also important to address the perception of security teams as blockers. Security can’t afford to be ‘the Department of No’ or the ‘Department Who Cried Wolf’. In supply chain operations where efficiency and speed are paramount, some stakeholders can see cybersecurity as an obstacle to productivity rather than a safeguard against disruption.

Shifting this perception means reframing from being a purely defensive measure. Board members respond to business impact, not just technical risks. Therefore, the focus should be on security’s value in protecting operational uptime, preventing financial losses, and maintaining customer trust.

For example, the WEF reports that organisations investing in proactive security measures experience significantly lower operational downtime – a direct business benefit to sell to the board. 

Aligning cybersecurity with business objectives will demonstrate how it protects revenue. Emphasising compliance benefits can also be effective, highlighting how investment in security streamlines regulatory adherence and reduces legal risks. These benefits can be backed up with examples of the cost of inaction, such as supply chain breaches leading to multimillion-pound disruptions.

A strong strategy will hit the sweet spot between security and efficiency. For example, bridging the gap between IT, OT, and supply chain teams, helps integrate security into operational workflows rather than becoming a barrier. There should be a focus on implementing security measures that enhance productivity, such as automated threat detection and pre-approved security controls for suppliers.

Making supply chain security a leading business priority 

The convergence of IT and OT has made supply chain security a critical business issue, not just a technical challenge. Cybercriminals are exploiting weak links in supplier networks, and most large organisations already identify supply chain security as their biggest cyber resilience challenge.

Without visibility, proactive investment, and board-level support, businesses will remain vulnerable to costly disruptions, regulatory penalties, and reputational damage. Security leaders must reposition cybersecurity as a business enabler to ensure it is integrated into strategic decision-making.

Enterprises must act now to secure their supply chains before a cyberattack forces their hand.

In recent years supply chains have become increasingly interconnected, creating both challenges and opportunities for change. While digitalisation has made our supply chains ‘smarter’, it’s also rendered the industry vulnerable to new kinds of disruption, both in the physical and digital realms. 

Cybersecurity is just one example. The ransomware attack on supply chain management specialist Blue Yonder provided clear evidence of the disruption such incidents can cause. An attack on the company’s managed services environment disrupted a number of grocery and retail stores in the UK. This left retailers struggling to pay staff and manage their schedules on time.

Such incidents show just how important scenario planning can be to avert these crises. If plans to mitigate potential impacts aren’t mapped out, these events have the potential to completely halt production, impacting revenue. Data is absolutely pivotal to the efficiency and efficacy of today’s supply chains. However, incidents like the one above show supply chain data currently isn’t being safeguarded or optimised effectively to circumvent real-world disruption.

That being said, many businesses are beginning to explore new technologies and techniques to improve resilience across their supply chains.

Supply chain data is being restricted

It’s no secret that the supply chain is a high-stakes, inherently complex industry. It’s made up of producers, warehouses, transport, distribution ports, and stores worldwide. If one blockage or breakdown takes place anywhere it can topple the entire system. Therefore, visibility is key to preventing knock-on effects.

However, extracting valuable insights from supply chain data in raw form can be difficult. Traditional data models struggle to analyse complex data due to their file-like structure. Because they predominantly consist of a rigid format of tables, rows, and columns they struggle to capture the intricate connections between different sets of data.

The invisible string in the supply chain made visible

Unlike these legacy models, graph databases are uniquely structured using ‘nodes’ and ‘edges’. ‘Nodes’ are used to represent a person, a product, a place, or an existing entity in a graph. ‘Edges’ represent the relationship between two nodes – i.e. how they are connected to one another. These properties are invaluable if you want to visualise a supply chain as the network in a digital form.

If a supply chain organisation wanted to optimise transportation, for example, they could create a node to represent each wholesaler and connected retailer. They then use an edge to show their relative distances and run the appropriate query, or request, in the model. The resulting output should highlight for the analyst what, in practice, should be the ‘best’ – fastest and cheapest – supplier from which goods can be transported ready for purchasing.

Understanding the relationship between two different entities ahead of time can be immensely useful in the event of unexpected disruption. Take the crisis in the Red Sea for instance. There, shipping companies are enduring rocketing shipping costs and product delivery delays as a result of rebel attacks. Using graph technology in this way could allow those managing supply chains to pinpoint efficient alternative routes or solutions to get goods to suppliers, increasing resilience and minimising disruption.

It’s those edges linking each entity that make graph database technology a powerful tool for revealing insights – particularly in supply chains, which are graph-like networked structures, made up of a myriad of connections, after all. It’s a stark contrast with older, more rigid data models, where these relationships are much harder to uncover due to the way the data is structured.

Digital twins for combating cyber risks

Supply chain resilience isn’t purely about the physical realm, though. Incidents such as the cyber attack on Blue Yonder can have a huge impact on digital operations. Many organisations are now exploring digital twin technology as a tool to combat attacks. The applications of which spac from before the attack begins through to post-incident analysis.

They’re doing so by creating virtual replicas of supply chains in what are called ‘knowledge graphs’. These are used to test different scenarios and generate multiple outcomes of cybersecurity risks. In essence, this means access to a connected, virtual model of their supply chain. Using this model, companies can gain a holistic, granular picture of a network. They can know intimately which systems connect to one another. Not only that but they can see users and the groups they belong to, as well as their permissions. And so on. The digital twin then becomes more accurate over time as details of recurring or interconnected events are captured, allowing cybersecurity and supply chain analysts to take faster and more effective action in the present, and inform how they respond in the future.

When those connections are made visible to cybersecurity analysts, it’s easier to identify where the greatest vulnerabilities impacting critical resources lie, and potential attack paths to those resources. Plus, they can also predict which attacks are the most likely to succeed by attaching the probabilities to each of those pathways. This then allows them them to bolster security accordingly.

That knowledge is immensely valuable because it clearly signposts when organisations need to map out other viable routes, transit times, and cost implications. The combination of cybersecurity modelling and supply chain optimisation becomes an impactful formula for organisations to stay ahead of curve balls in the real world and re-prioritise resources in quicker succession.

How the evolution of graph data bases is mitigating against cyber threats

The complex web that is the global supply chain is constantly under threat. However, organisations can become more resilient by tapping into the power of graph databases.

It’s the relationships in supply chain data that reveal the most efficient ways of rebounding from unforeseen incidents. Incidents that would otherwise be detrimental to business. In both the real and the digital world that deeper understanding of complex networks, and their level of resilience, is what can truly set organisations apart.

Managing increasingly complex and evolving cyber security risks across digital supply chains comes with the territory these days. No organisation is immune, and incidents like last year’s CrowdStrike outage show just how far the shockwaves from a mistake can reach. 

Despite due diligence, a bug still slipped through into a software update – a very high profile reminder that procedures can break down even when endeavouring to adhere to best practices. This adds further weight to the seeming inevitability of a security lapse impacting your organisation, regardless of where it originated from. 

In reality, it’s no longer a case of if a cyber incident will affect your supply chain, but how you will respond when it does.

A never-ending supply chain

Notwithstanding that supply chains are typically long and convoluted, to understand the full extent of their potential attack surface organisations must map all tiers, including indirect suppliers, agencies, contractors, and freelancers.

This means not only considering who your own organisation buys directly from, but also who your suppliers interact with and purchase from. While this may seem interminable, it enables you to conduct a more authoritative risk assessment, as well as determine degrees of mitigation.

Proportionality needs to be applied according to the type of supplier and the level of access they have to the corporate infrastructure. It’s a case of identifying the risk and assessing the scope of the potential damage that could result. This will avoid spending too much time on mitigating insignificant or low risks. But, generally speaking, it’s worth noting that too little effort is expended initially on understanding the true scale of the supplier ecosystem.

It’s therefore important to go beyond typical boundaries, investigating what data is given to suppliers and what it can teach an attacker about your business that could enable them to launch a more targeted and effective attack on you specifically. Look at common vulnerabilities in their systems that you may have disregarded. This includes weaknesses in third-party software or infrastructure that could compromise data or operations, inadequate risk mitigation measures across their own third parties, and outdated or vulnerable technology systems.  

With this visibility, calibrate risk profiles accordingly and don’t hesitate to take remedial action. This might involve updating contracts with more robust security requirements or even changing suppliers.

Offensive cyber security

It may sound obvious, but organisations shouldn’t wait for a security breach to happen internally or to start somewhere along the line before improving prevention and remediation plans. Proactively test the resilience of systems to assess how an incident could cascade through your ecosystem. 

Penetration testing on its own is not enough. Be on the offensive with red teaming (attack simulation) programs and bring in external specialists with fresh eyes to help identify weaknesses internal initiatives may have overlooked. Bear in mind that a multi-faceted approach to security will give better coverage – it should never be one dimensional.

And even with comprehensive security and attack simulation plans in place, it’s vital to test incident response and business continuity procedures.

How thorough is your testing?

Thorough testing your business continuity plans is vital to ensure you can rely on them to kick into action when an incident occurs. 

Ask yourself fundamental questions. For example: is there a clean copy of the critical data I need to resume business operations? Is it appropriate to keep a full copy of the data, or should I redact certain information? How do my mitigation plans change, depending on what data is compromised? Different companies will necessarily come to different conclusions, but don’t wait for a security failure to see if the mitigations work. Test, and test again to uncover faults and deficiencies to ensure your organisation will be in a stronger position in the midst of a real event.

It isn’t possible to forecast exactly the way the dominos will fall during a security incident, but ensuring a comprehensive approach to business continuity testing is the best preparation. Anything resembling a tick box exercise is not sufficient and could give senior management a false sense of confidence.

Needless to say, managing supply chain risk is not a one-time effort – it’s an ongoing process that requires continuous vigilance, lateral thinking, and remedial action.

All-round resilience 

To build more resilient supply chains organisations must go beyond traditional risk assessments and adopt offensive cyber security strategies. 

By seeking out weaknesses and simulating attacks, organisations can bring to the surface risks often overlooked by conventional methods. Offensive cyber security enables a deeper understanding of supply chain vulnerabilities, particularly those posed by third-party vendors. 

This strategic shift not only improves defences but also scrutinises the efficacy of disaster recovery plans, essential for reliable business continuity.

Companies around the world are emerging from a difficult year for supply chains. As 2025 continues, they must equip themselves with up-to-date knowledge on challenges, trends and innovations to formulate the best strategies to handle increased vulnerabilities. 

This is particularly true of supply-chain cybersecurity, which focuses on securing the entire chain of suppliers and service providers that support an organisation’s operations. 

From geopolitical tensions to ransomware and artificial intelligence (AI)-driven threats, several factors are likely to affect supply chains this year. The concept of managing supply chain cybersecurity is not new. However, the increasingly rapid shift towards digitalisation and interconnected systems has created new vulnerabilities. Increasingly, criminal organisations and state-sponsored actors are moving to exploit these weaknesses. Their targets range from corporations to critical infrastructure, for reasons ranging from financial gain to political objectives. Regardless of the motivation, the results are often regional and global supply chain disruptions. 

The impact of a cybersecurity failure affecting a vendor, partner, or service provider can be disastrous for a company, an entire sector, or even a nation.

Financial Impact and Cascading Effects

NIST’s Cybersecurity Supply Chain Risk Management (C-SCRM) defines supply chain cybersecurity risk as “the potential for harm or compromise that may arise from suppliers, their supply chains, their products, or their services.” Securing a company’s supply chain from a cybersecurity perspective is addressed by international standards and regulatory frameworks such as ISO 27001, NIST CSF, and NIS 2.

In the past few years, cyberattacks have severely impacted supply chains across various industries, a trend that we expect will continue in 2025. Ransomware attacks have compromised supply chain automation solutions, affecting inventory management, order processing and logistics systems. Significant hacking events have frozen critical resource distribution, prompting regulatory action to enhance cybersecurity measures for critical infrastructure. 

It is not only businesses that are affected by such incidents. Cyberattacks in the logistics industry have disrupted and affected global trade routes, increasing transportation costs and creating supply chain bottlenecks. In cases of severe impact, the disruption of supply chains and business operations can even affect economic stability, highlighting the potential for hackers to exert significant influence on the real economy.

What to Expect in 2025

As we enter 2025, several geopolitical and technological trends are poised to shape the cybersecurity landscape. Here are some of our key predictions:

Geopolitical tensions and digital sovereignty. 

Governments will increasingly prioritise control over their digital borders. Cyber conflicts will continue to escalate, with major supply chain actors in sectors such as energy, transportation, and technology remaining prime targets.

Continued focus on ransomware and extortion

Both state-sponsored and independent hackers will likely target private sector entities for financial gain. Vendors and contractors will remain vulnerable entry points, enabling attackers to exploit trusted relationships to compromise downstream organisations.

Increased attacks on Operational Technology (OT)

Cyberattacks on machinery and robotics in industries relying on OT could severely disrupt production and service delivery, directly impacting supply chain resilience.

AI-Driven Threats

The commoditisation of AI may lead to malicious use of the technology by some attackers. At the same time, the process of companies adopting new technologies may create unintended consequences. In some cases, these consequences might end up exacerbating supply chain vulnerabilities.

Addressing Supply-Chain Cybersecurity Resilience Challenges

Securing supply chains from cyber threats is inherently complex due to the nature of supply chains themselves. Cyber disruptions in planning, sourcing, manufacturing or delivery can have immediate financial and contractual repercussions. Compounding this complexity is the interconnectedness of supply chains, with companies depending on both internal and external suppliers and customers. A disruption at any point in this network can cascade across multiple tiers of suppliers and customers.

When it comes to securing supply chains, the challenge lies in managing not only IT systems—including on-premise and cloud environments—but also applications, databases, networks and OT. Despite these complexities, adhering to foundational cybersecurity practices can significantly enhance supply chain resilience:

Know your processes and assets

Maintain an accurate inventory of all critical systems, processes and dependencies.

Understand third-party dependencies

Identify and assess the cybersecurity posture of key third-party providers and their subcontractors.

Apply cyber hygiene controls

Implement vulnerability management, enforce access control policies, adopt secure development practices and establish backup and disaster recovery plans.

Prepare for the worst

Develop and regularly test robust incident response plans.

These measures may be manageable for smaller organisations with limited assets and partners. However, large corporations with thousands of assets and numerous critical third parties require a risk-based approach. This strategy helps prioritise investments in security controls that mitigate business risks within the organisation’s risk tolerance.

By combining foundational practices with a risk-based approach, organisations can better navigate the challenges in supply-chain cybersecurity and build resilience against future threats.

Black Friday 2024 is over. This year, while customers’ enthusiasm for in-person shopping was muted, online retailers saw their revenues rise yet again year-on-year. While the shopping extravaganza can provide numerous opportunities for retailers, brands also face issues such as demand fluctuations, out-of-stocks, inventory mismanagement, and increased cyber threats — especially as online shopping continues to rise in popularity.

This year, we spoke with a range of industry experts to take a deep dive into the challenges Black Friday poses for supply chains, and understand how the industry can use innovative tech to address them in the upcoming holiday shopping period and beyond. 

Streamlining inventory management

There are several challenges that retailers and supply chain brands face during Black Friday and inventory mismanagement remains at the top. During the busy shopping period, brands need to maintain high inventory accuracy for effective order fulfillment. According to Amber Hovious, VP of Marketing & Partnerships at Teamwork Commerce: “During Black Friday, the focus on stock management should become a top priority.” 

“Being able to provide high-quality experiences is one thing, but it is a waste of time if a retailer doesn’t have a specific product available. With increased traffic both online and in-store around Cyber Weekend, the potential for stockouts, and ultimately, disappointed customers, increases significantly.” 

Similarly, Dean Drew, President of the RFID Solutions Division at SML Group, highlights the crucial role of inventory replenishment during Black Friday. Frew believes: “Replenishment  during peak holiday sales periods is critical in order to avoid out of stocks in distribution centers and on the sales floor.”

It is clear that retailers should find ways to navigate the right solutions to meet their specific needs. Teamwork’s Hovious suggests: “Once Black Friday sales begin, retailers need to utilise the right technology that can track inventory across all locations, from the supply chain to the shop floor. The right platform can keep an accurate view of all sales – both online and in-store – as well as stock, flagging when inventory levels begin to deplete. From here, associates can replenish shelves, or they can redirect more stock from warehouses to various locations depending on sales demand.”

“Product availability can make or break a retailer’s performance during Black Friday.” — Amber Hovious, VP of Marketing & Partnerships, Teamwork Commerce

There is no denying that brands should invest in cutting-edge technologies that can enable them to keep accurate track of inventory which is key not only to drive sales but also to deliver high-quality customer experience. Highlighting the importance of inventory accuracy, Hovious adds: “Product availability can make or break a retailer’s performance during Black Friday. There is no greater disappointment for a customer than discovering an item they want is out of stock. By getting their inventory practices right during Black Friday, retailers can maximize their opportunities for success.”

When it comes to ensuring inventory accuracy, technology such as item-level RFID can be instrumental. SML’s Frew suggests: “By employing item-level RFID, retailers can easily track stock levels across their entire supply chain. This enables brands to identify individual products and components and trace them throughout the supply chain from production to point of sale.” Explaining why brands must use RFID technology during Black Friday, Frew adds: “It [RFID] provides retailers with supply chain clarity and sets the foundations for an efficient operation during Black Friday weekend.”

Cybersecurity & crime during Black Friday

Cybercrime remains a pressing concern during the busy shopping season. Dominik Birgelen, CEO of Oneclick AG Group points out: “Black Friday is often a busy period, providing countless opportunities for supply chain businesses. But, it’s also a prime time for hackers seeking vulnerabilities during the busy period. The supply chain sector remains a lucrative target for cybercriminals, having significant amounts of critical data.”

Cyber attacks can significantly impact operations during busy periods, along with other severe consequences. Birgelen highlights: “Cyberattacks can easily disrupt supply chain operations, resulting in delays, lost revenue, and a damaged reputation. This, in turn, can hinder the long-term growth of supply chain businesses.” Outdated software and the lack of technologies can lead to increased vulnerabilities. To protect themselves from cybercriminals, retailers and supply chain companies should lean on robust security solutions. Birgelen advises companies to use zero-trust solutions. He says: “By deploying advanced solutions based on the Zero Trust Architecture (ZTA), supply chain operators can ensure that suppliers, warehouses, and logistics systems operate securely without interruption.” 

In addition to cybercrime, theft continues to be a serious issue for brands, increasing retail shrink. According to Sarah Bird, Head of Local Services at NBCS: “Supply chain crime has been making the headlines recently as a significant amount of cheddar was recently stolen from the London cheese producer Neal’s Yard Dairy – a fraudster impersonating a French retailer managed to scam the business.” Businesses must invest in significant in-store security measures to reduce losses while ensuring high-level security for their staff. 

Black Friday and beyond

To capitalise on Black Friday opportunities, businesses must first address inventory and security issues. As per industry experts, leaning on innovative technologies can be a wise choice for brands to empower themselves and drive growth. 

Those who can get the right tech stack in place can operate effectively, navigate the season’s demands and achieve sustainable growth.

Data security issues have become a new frontier for supply chain disruptions in 2024. While much of the recent discussion around supply chain volatility has focused on international conflict, disturbances in key shipping lanes and ongoing trade tensions, those who work in international logistics have started to sound the alarm on the scale of cyber threats for supply chains. 

Data disturbances and risk aversion 

It is easy to see why supply chain managers are so concerned. The modern supply chain ecosystem thrives on data exchange between trading partners. But the exchange of important and often sensitive data between disparate systems and different trading partners leads to risk. What’s more, in today’s supply chain ecosystem the use of IT systems to optimise delivery is all but a given. However, this means when things do go wrong businesses are uniquely exposed to IT outages or data breaches. The CrowdStrike outage, to take a recent example, had a ripple effect across global supply chains, causing many companies’ operations coming to a near standstill.  

However, technological backsliding or a retreat from the use of cutting-edge technology in supply chain ecosystems should not be the lesson taken from the increased prevalence of cyber threats. 

Data sharing and collaboration do not come with data security issues by necessity. The important thing is for businesses to take a more considered approach when integrating data sharing technology into their supply chain operations. 

The case against technological backsliding 

To understand why technological retreat is far from the optimal strategy for companies worried about data breaches and cyber threats in their supply chain ecosystems, we need a better sense of the problems at hand. 

Most companies are understandably wary of exposing sensitive data like intellectual property, pricing strategies, or production details through a data exchange platform. And this sort of anxiety does not stop with data exchange platforms. 

To take another example, the recent experiences of many OEMs and LSPs with Transportation Management Systems (TMS) and visibility platforms have eroded trust. These solutions, intended to enhance collaboration, have in many instances collected information and data without explicit approval. Some organisations end up using this data, even if anonymised, for purposes beyond the original scope of the agreement, or even sold to third parties. This raises critical questions about data ownership and transparency within the supply chain ecosystem.

Clearly, hesitation surrounding data security is a valid concern for supply chain managers and the natural reaction might be to retreat from using any platform, building data fortresses to insulate from risk. 

This would be a mistake, however. Limiting data sharing hinders collaboration and reduces flexibility within supply chains. Without good data on the status of each linkage within a supply chain ecosystem, companies and their trading partners are running blind. This means that if data security issues do arise, they are even harder to diagnose and deal with. The key, therefore, lies in finding the right balance between data security and collaboration. 

Setting up secure supply chain ecosystems  

At its most basic level, a data exchange network with enhanced security features improves cyber security compared to traditional visibility platforms, offering robust security protocols, access controls, and audit trails. It is worth going the extra mile when integrating these processes. However, securing the data exchange network is just one piece of the puzzle for supply chain managers. 

A truly secure supply chain ecosystem requires a multi-layered approach. Ultimately, building trust through transparency is key. Companies need to understand how their data is being used and protected within the supply chain ecosystem. And IT systems that have interoperability at their core are central to that objective. 

Interoperability for supply chains means secure and seamless communication and data sharing between different systems applications and trading partners, technologies, and organisations. This reduces bottlenecks and provides the sort of data that stakeholders or security partners need to respond to issues in real time. What’s more, it enables the integration of diverse security protocols, ensuring that organisations can more consistently protect their data (and that of their partners) as it moves through various stages of the supply chain. Interoperability also facilitates collaboration and trust between trading partners by standardising data security practices, minimising vulnerabilities caused by isolated or incompatible systems. Ultimately, it strengthens the overall resilience of supply chain ecosystems, making them more agile and better equipped to mitigate risks.

As always, there’s no silver bullet 

Of course, it is important to remember that interoperable systems are not a silver bullet against cyber threats and that a multi-layered security framework remains essential. 

However, supply chain managers need to reach a stage where they are confident in that technology that their systems are using. This is key to avoid technological backsliding and less efficient supply chain ecosystems, but also to ensure systems are secure in the face of modern cyber threats.

At this year’s LogiPharma 2024 event, we caught up with some of the pharmaceutical supply chain sector’s thought leaders. We asked them about everything from digital transformation to AI and the climate crisis, hoping to learn more about the trends shaping the industry, and how their organisations are responding to the challenges ahead. 

Here’s  Shabbir Dahod, President and CEO, TraceLink, discussing the most pressing issues facing the global pharmaceutical supply chain. TraceLink is a leading end-to-end digital network platform for intelligent orchestration of the supply chain. It enables visibility, traceability, and collaboration between supply chain partners. Through its Opus Platform, solutions like the Multienterprise Information Network Tower (MINT), and its B2N Integrate-Once™ network, TraceLink connects manufacturers, suppliers, distributors, healthcare providers, and regulatory agencies on a single platform. This enables seamless data sharing, real-time tracking of products, and ensures regulatory compliance. These benefits are especially important for for pharmaceutical products where patient safety and drug authenticity are critical. TraceLink’s solutions help reduce inefficiencies, prevent drug shortages, and verify timely delivery of critical healthcare products.

1. What are your biggest takeaways from this year’s LogiPharma event?

At LogiPharma, supply chain digitalisation emerged as a key theme. It highlighted how digital platforms are transforming pharmaceutical operations by offering real-time visibility, better coordination, and reduced inefficiencies. 

Companies are increasingly relying on these tools to meet the growing demand for faster, more accurate delivery of medications. Another prominent topic was the use of AI for supply chain resiliency. Here, predictive analytics are helping companies anticipate disruptions and optimise inventory. 

Additionally, DSCSA compliance was a major focus, stressing the need for digital tools to ensure traceability, product safety, and regulatory adherence.

2. More broadly, what kind of shape does the pharmaceutical supply chain find itself in after such a remarkable few years? 

The pharmaceutical supply chain today is navigating a period of intense transformation and pressure. 

Factors such as COVID-19, political conflicts, and inflation have shown us the weak points in the supply chain, such as over-reliance on certain regions for manufacturing, a lack of visibility across the supply chain, and challenges in meeting demand surges. However, these challenges have given rise to great opportunities to transform legacy supply chain processes, which have previously held back the industry. 

For example, we’ve seen tremendous innovation over the last few years. Companies are adopting AI to improve resilience, visibility, and collaboration across the supply chain. The focus is shifting toward greater agility and patient-centric approaches to ensure the continuous supply of essential medicines.

Looking ahead, the pharmaceutical industry’s adoption of new technologies is creating a more resilient and agile global supply chain. 

These advancements, coupled with a growing emphasis on patient-centric approaches, position the industry to overcome current challenges and build a stronger, more adaptable supply network. With continued collaboration and innovation, the future of the global supply chain holds great promise for ensuring the consistent delivery of essential medicines to patients worldwide.

3. What do you feel are the biggest lessons that the last few years have to teach us about the future? And are modern supply chains prepared to deal with the kind of ‘black swan’ events we’ve seen recently?

In recent years, supply chains have learned that resilience and adaptability hinge on real-time, end-to-end visibility across the entire network. This level of visibility allows companies to make proactive, data-driven decisions, swiftly reroute operations, and respond to sudden disruptions in ways that were previously unimaginable.

The move towards digital transformation has accelerated the adoption of advanced technologies like AI and predictive analytics. These tools turn real-time data into actionable insights. It helps supply chains not only detect potential risks but also intelligently orchestrate responses. For instance, AI can analyse patterns in data to anticipate shortages, and automation can trigger adjustments in inventory or production levels before disruptions impact customer delivery.

Furthermore, real-time visibility enhances collaboration with suppliers and partners across the globe. Rather than being limited to isolated insights, companies are now operating within interconnected multi-enterprise ecosystems where data is shared seamlessly across the supply chain. This transparency fosters a collective agility that strengthens resilience, ensuring that everyone from manufacturers to distributors to retailers can adjust in sync.

With this digital transformation and the focus on real-time data, modern supply chains are more agile, resilient, and prepared to navigate future “black swan” events. The shift towards end-to-end network visibility and intelligent orchestration is not just about meeting today’s challenges. It’s also about setting a foundation for a new era of supply chain management—one where AI-driven foresight and flexibility become the norm rather than the exception.

4. What should pharmaceutical supply chain leaders have at top of mind when they think about implementing GenAI? What is TraceLink doing with the technology? 

TraceLink’s network platform plays a critical role in feeding data lakes. It does this by capturing and consolidating vast amounts of real-time supply chain data from multiple stakeholders, including manufacturers, distributors, and healthcare providers. 

This networked approach ensures that data, such as transactional records, inventory levels, shipment tracking, and compliance information, is aggregated and structured efficiently for analysis. By feeding this data into data lakes, businesses can leverage advanced analytics, AI, and machine learning to derive actionable insights, enhance decision-making, and optimise supply chain performance.

For CSCOs looking to start their generative AI journey, the first step is to evaluate their current data infrastructure. Generative AI relies heavily on clean, high-quality data. Therefore, understanding the maturity of existing data systems, identifying gaps, and ensuring data governance policies are in place is critical. This involves assessing how well the organisation collects, stores, and manages supply chain data, as well as determining whether the current IT infrastructure can support the integration of advanced AI technologies​.

Next, CSCOs should align AI initiatives with business goals, ensuring that AI use cases—such as demand forecasting, inventory optimization, or supply chain risk mitigation—are directly tied to strategic objectives. They need to prioritise areas where AI can deliver immediate and measurable value.

It’s also crucial to build cross-functional collaboration between IT, operations, and supply chain teams. AI implementation requires a strong partnership between technical experts and supply chain leaders to ensure that solutions are both technically feasible and operationally relevant​.

Finally, start small and scale. Pilot programs are an excellent way to test AI capabilities before putting them in place throughout the organisation. These pilots help identify potential challenges, refine AI applications, and build confidence within the organisation. 

5. What’s the next step for pharma supply chain leaders and how can they take it? 

The pharmaceutical supply chain can take the next step forward by focusing on a few key strategies. First, digitalising end-to-end information flows is critical because it lays the groundwork for every other advancement. Without digitalisation, supply chains lack the unified, real-time data necessary to track product movement, monitor quality, and proactively respond to disruptions. 

Digital information flows make it possible to see and manage the entire supply chain as a connected ecosystem, breaking down silos and enabling faster, data-informed decisions at every stage. 

Collaboration is equally important. By encouraging better integration between suppliers, manufacturers, and logistics partners through shared digital platforms, the industry can improve communication and alignment across the entire ecosystem.

To build resilience and agility, the industry must diversify suppliers, regionalise production. Not only that, but it should use AI-driven forecasting to predict and mitigate risks. 

Lastly, as the industry shifts towards patient-centric models, supply chains will need to adapt to handle smaller, specialised shipments. This is particularly true for sensitive products like gene therapies and vaccines. This can be achieved by investing in advanced logistics infrastructure, such as temperature-controlled systems, to ensure product integrity​.

From natural disasters and geopolitical conflict to the threat of a future pandemic, the challenges facing global pharmaceutical supply chain operators are daunting. The global supply chain landscape is becoming more unpredictable and prone to disruption. Not only this, but supply chain organisations are, some argue, ill-equipped to tackle these challenges. 

At this year’s LogiPharma 2024 event, we caught up with some of the pharmaceutical supply chain sector’s leading executives to learn more about them, their analysis of the trends shaping the industry, and how their organisations are responding to the challenges ahead. 

Gísli Herjólfsson is CEO and co-founder of Controlant, which provides real-time monitoring solutions for pharmaceutical supply chains. 

1. Would you be able to give me a brief introduction to your role and the company you work for?

The seed for Controlant was planted when a group of friends were studying together at The University of Iceland, experimenting with wireless technology and real-time data access. We quickly realised that applications of simplification, automation, and real-time monitoring for supply chains for perishable goods added up to a business idea. Founded in 2007, Controlant was based on this idea. 

The swine-flu epidemic in 2009 changed the course of Controlant permanently. We realised that our technology would have the greatest impact in pharma. By the time the Covid-19 pandemic broke out, Controlant had developed its pharma-validated devices, platform and services and was in collaboration with pharma companies around the world. The global pandemic put the company’s solutions to a test of speed and scale not seen before. The crisis proved the value that real-time visibility brings to pharma supply chains. 

Today, Controlant is a global leader in the digital transformation of pharma supply chains. Its solutions are trusted by leading pharmaceutical companies and logistics providers to make their supply chains more efficient, reliable, and sustainable. Our vision is to unleash the power of people and technology to deliver zero-waste supply chains for patients, the planet, and our partners.

Inside LogiPharma 2024

2. What is the value of events like LogiPharma 2024? How important is this conference in the supply chain pharma calendar?

Partnerships are incredibly important to us at Controlant. LogiPharma is an important venue for the global pharma community. The event gives us an opportunity to connect with our partners, customers, and industry experts.

In-person collaboration on supply chain challenges and solutions, and sharing our expertise of real-time visibility for pharma supply chains, for example through our keynote, are important for continuous innovation in the industry. Access to industry subject matter experts, including speakers on critical challenges such as waste reduction, drug delays, sustainability, and regulatory change, helps us deepen our understanding of where the industry is heading and at what pace. These face-to-face interactions strengthen our partnerships with our customers. Not only that, but inspire us as we develop new solutions to advance the industry in a way that benefits patients and the planet.  

3. Is there anything that makes this event stand out for you? How is it different from others you’ve attended?

What sets LogiPharma apart is the collaborative environment which encourages the development of forward-thinking strategies, allowing attendees to future-proof their supply chains with robust technologies and visibility platforms. The biggest takeaway from this year’s LogiPharma was the opportunity to engage with colleagues and customers. Through networking with them, we aim to better understand what matters most in today’s supply chain landscape. 

4. What are the biggest takeaways from this year’s LogiPharma for you?

It was clear that many pharmaceutical supply chains are still operating with outdated technology. This hinders supply chain visibility, process automation, and optimisation of supply routes. There is a significant opportunity to enhance efficiency, drive digitalization, and improve sustainability efforts across the industry.

One of the major barriers holding companies back is the reliance on disparate systems, inconsistent data models, and fragmented business units. The discussions at LogiPharma revealed a clear urgency to future-proof supply chains with the best technology available, such as real-time visibility technology, and ensure any solution implemented is sustainable at scale.

It was inspiring to hear from some of the most forward-thinking companies and brightest people in our space. These people have embraced technology to future-proof their supply chains, addressing the triple bottom line of people, planet, and profit.

Global supply chain trends and challenges 

5. Given the backdrop of the global disruption, how would you sum up the pharmaceutical supply chain space today? 

The Covid-19 pandemic was a great testament to learning by embracing the impossible. Controlant had the privilege of being a part of a collaborative effort defined by unprecedented willingness from an entire ecosystem to embark on a transformational journey. Faced with the task of delivering COVID vaccines in record-breaking time at a global scale, transformation was the only way. By embracing technology and working in a trusted partnership, the outcome was the safe delivery of billions of doses of vaccines shipped to destinations around the world with a 99.99% success rate. 

The pandemic and other disruptions to global supply chains have only highlighted the impact of real-time visibility on all aspects including patient safety, efficiency, resilience, and sustainability. With impressive growth in drug development and clinical trials – including new, revolutionary treatments on the horizon such as cell-and-gene and personalised medicine – the parameters and challenges placed on pharma supply chains will only grow. Without real-time visibility, pharma supply chains stand to become a bottleneck rather than an enabler for treatments reaching patients worldwide without delay, while safeguarding product quality and minimising environmental footprint. 

6. What do you feel are the biggest lessons supply chains have learnt over the past few years? Also, how well equipped is the modern day supply chain to deal with ‘black swan’ events?

The implications of not taking leadership when you see new technology on the horizon is triple negative effect. Delaying hurts patients, planet and profits. 

Just as the pharma industry is making great strides by applying technology such as AI to drug development, clinical trials, diagnosis, there are vast opportunities in applying technology to the supply chain to reduce waste and ensure patient safety throughout. 

Major events in recent years have showcased the value of having a single source of truth, data that is accurate, reliable and in real time, and sharing the data with all stakeholders involved in the process of getting the product safely, efficiently and sustainably to its destination. Adopting real-time visibility is a game-changer, especially when dealing with deviations or extreme events.

Sustainability in the supply chain 

7. Sustainability is an important item on most Chief Supply Chain Officers’ agenda. Amid government legislation and changing customer demands, is a sustainable supply chain a non-negotiable in today’s world?

Controlant’s zero-waste vision for pharma supply chains is at the heart of everything we do, whether internally in our operations or in the solutions we develop for our customers. Tackling waste along the pharma supply chain while not making any compromises to patient safety is the key driver in all we do.

There is no planet B. That makes it even more important that we partner for impact along the value chain for positive impact.  

Our customers are highly ambitious, not just when it comes to treatments, vaccines and medicines for patients to improve health outcomes and quality of life for as long as possible. They are also very ambitious when it comes to their sustainability impact. Our customers need like-minded partners like Controlant that can support them with measuring and reporting the environmental, social, and governance performance. We are their strategic partner for sustainable supply chains, enabling them to meet their sustainability targets.

8. In what ways have you incorporated sustainability into your own operations?

Controlant has a clear vision and demonstrated track record for incorporating sustainability into its operations. Not only that, but we also extend our impact beyond our own operations, to customers, partners, and the wider community. 

With an estimated 30% of all medicines wasted globally, the greatest impact we have is through our real-time visibility solutions that enable pharma companies and logistics providers to reduce waste along their supply chain. With data at their fingertips, the pharma industry can take proactive steps to reduce waste from lost or discarded medicines and vaccines, and reduce the need for extra manufacturing and transportation of safety stock, thereby lowering emissions, costs, and time required to get medicines and vaccines to where they are needed.

The Saga logger, our flagship IoT device, is re-usable and enables our customers to reduce emissions by 86% per pharma shipment. At our service centres, we repair, recharge and recalibrate devices for reuse. Our devices are eco-friendly and designed for extended durability. The first life-cycle assessment of a Controlant product was conducted in 2023 for the Saga logger. The assessment revealed that Controlant avoided more than 8,203 tonnes of CO2 equivalent for its customers in 2023, the equivalent of driving more than 30 million kilometres in an average fuel-powered passenger vehicle.

On our journey toward sustainability leadership, we have reached several significant milestones. In May 2023, Controlant’s science-based target to reduce scope 1 and 2 emissions by 42% by 2030 was validated by the Science Based Targets initiative. This made Controlant one of the first companies among industry peers to have a validated target. We are proud to report that our overall emissions decreased by 68% in 2023, with a 38% reduction in scopes 1 and 2, putting us on track to meet our science-based target. 

9. And how else are you promoting sustainability?

Major ESG rating agencies also endorsed our progress and commitments towards sustainability. In 2024 EcoVadis, the world’s most trusted business sustainability rating provider, rated Controlant Silver. That placed us in the top 15% of more than 125,000 companies rated globally from a variety of industries. Controlant’s coordinated action on climate issues was recognized by the Climate Disclosure Project (CDP), the global non-profit that runs the world’s leading environmental disclosure platform, with a B- rating. In addition, we also received a B rating in the CDP Supplier Engagement Rating, which measures the company’s performance on governance, targets, Scope 3 emissions, and value chain engagement. 

Controlant is a participant of the UN Global Compact, and supports the United Nations Sustainable Development Goals. Community engagement is integral to Controlant and its culture, connecting the company beyond its traditional value chain. 

By collaborating with local causes and initiatives, we strive to put our weight on the scale when it comes to our social performance and give back to the communities that we are a part of. A flagship of our community engagement is our partnership with UNICEF, launched in 2023, with a focus on child immunisation. As part of the collaboration, the two partners, joined by the Chief Epidemiologist of Iceland, launched an awareness campaign on childhood vaccinations in Iceland in early 2024, spotlighting immunizations as one of the most effective ways to prevent infants and children from falling seriously ill or dying from preventable diseases. Our volunteer day is another way we empower our global team to have a positive impact on the community. It gives every member of our team the opportunity to take one paid day to pursue volunteering activities.

The future of the pharma supply chain

10. What’s next for the pharmaceutical supply chain industry?

Future-proofing the pharmaceutical supply chain requires a forward-thinking approach, built on a foundation of strong partnerships and collaboration. In today’s interconnected world, no single entity can drive meaningful change alone. By working together across the value chain, we can tackle the complex challenges that lie ahead.

It’s also essential that we embrace technology with confidence. The next evolution of our industry will be powered by real-time data. Accurate, precise, and actionable insights are critical for proactive decision-making. Real-time visibility enables companies to become more proactive and agile. It means they’re not just reacting to disruptions, but anticipating and strategically managing them.

The digitalization of supply chains is the key to unlocking these insights. By harnessing the power of data, pharmaceutical companies and logistics providers will be better equipped to drive efficiency, reduce waste, and enhance their ability to deliver life-saving therapies to patients worldwide. This is how we move the industry forward—by leading with innovation and a shared commitment to excellence.

11. Are there any of Controlant’s exciting projects, past or present, that you’d like to highlight?

Controlant provides a holistic set of solutions for pharma supply chains encompassing IoT devices, the cloud-based Aurora platform, and dedicated services including our 24/7 monitoring and response teams. Our comprehensive solution offering puts us in a unique position to apply our industry expertise and technological leadership to invent new solutions that help pharma and logistics providers future proof their supply chains. 

Highlights from our product pipeline include Zero-Touch Release, our recently launched Supply Chain Soft Spots, and the Saga Card, now in the pilot phase. 

Controlant’s GxP-validated “zero-touch” automated release process is leading in automating supply chain processes to improve resilience and reduce the risk of disruption. The zero-touch release application automates the product release process. This simplifies and accelerates release processes while relying on verified data sources to ensure quality standards. Using this platform, pharmaceutical firms can drastically reduce lead times and save on work hours. The zero-touch approach speeds up time to market, improves OTIF performance, reduces expenditure, and minimises carbon footprint. 

The Supply Chain Soft Spots dashboard addresses inefficiencies in the supply chain. It helps customers identify the lanes and other places along the chain where issues such as temperature deviations occur. Supply Chain Soft Spots is a dashboard with an interactive map-based interface. The solution allows for identifying where critical temperature excursions occur with Points of Interests, such as airports and harbours, automatically mapped through 3rd party data.

12. How exciting a future does the pharmaceutical supply chain have? 

For agile pharma companies that are ready to adopt new technologies, the pharmaceutical supply chain has a very exciting future. Pharma companies are leading the way in developing new therapies that can transform patients’ lives by improving health outcomes and quality of life. Controlant’s global team is driven by the goal of ensuring patient safety while reducing waste in the pharma supply chain. 

We are proud to support our customers in delivering therapies to patients worldwide in a safe, efficient, and waste-free manner. 

Every day, we work to make a positive impact by cutting waste at every stage, and ensuring patient safety. This ultimately benefits patients by improving health outcomes, increasing access to medicines, and ensuring the safety and effectiveness of treatments.

Global supply chains continue to be a favourite target for cybercriminals. This isn’t surprising given that targeting a single supply network can allow threat actors to cause large-scale disruption. For cybercriminals, it’s an opportunity to hit multiple targets with a single arrow. 

Since 2018, the number of businesses impacted by supply chain attacks has increased by over 2,600%. According to ITRC’s data, more than 54 million organisations were impacted last year across 242 breaches. 

These statistics and recent high-profile attacks on giants like Toyota, the NHS, and Ministry of Defence indicate that businesses need to rethink their approach to conventional cybersecurity across the entire supply chain.  

The old ways of dealing with cyberattacks are no longer enough. Traditional methods like perimeter defences, incident response, and backups are still important practices for cyber hygiene, but they don’t complete the cyber resilience puzzle. 

In the modern threat landscape, businesses need to anticipate breaches and arrange their defences accordingly. There is an increasing volume of potential entry points for an attack. Almost every supplier is now incorporating cloud assets within their networks, which is greatly expanding the attack surface. 

So, breaches are inevitable, and the focus should be on containing them.

Cloud migration and its new attack vectors

The growing adoption of the cloud has been a blessing for supply chains. However, rushing into cloud adoption without the necessary safeguards and pre-emptive strategies puts businesses at risk from cybercriminals. 

For instance, traditionally isolated systems, such as ICS and OT systems, are now connected to cloud infrastructures. These physical systems were designed without security in mind and don’t have the same in-built security mechanisms as other internet-facing assets. 

So, integrating them with cloud systems automatically instils a certain extent of vulnerability. This is why cloud-based attack vectors have significantly increased across supply chains. Cybercriminals are constantly exploiting vulnerabilities in cloud configurations, APIs, and third-party services. 

For example, attackers can gain access to cloud environments through phishing campaigns, targeting employees or by exploiting weak authentication protocols. Once inside, they can move laterally across the network, potentially reaching critical operational systems. This level of exposure is deeply concerning for businesses with internet-facing assets across their supply chains.

Additionally, the use of third-party cloud services introduces further risk. Companies today have to rely on the security practices of their vendors, which may not always align with their own security standards.

Disruption and downtime over data exfiltration

Cybercriminals also recognise that disrupting supply chains can be far more damaging (and profitable) than stealing data. For instance, the attack on Toyota led to a temporary shutdown of production at multiple plants. The incident highlighted that even a short-lived disruption can have significant ripple effects throughout a global supply chain, especially on businesses operating on just-in-time (JIT) production schedules.

For ransomware gangs, targeting operational up-time also increases their likelihood of attaining a ransom. In 2023, for example, the CLOP ransomware group, exploited a zero-day vulnerability in the MOVEit software, which is widely used for secure file transfers. This breach impacted hundreds of companies globally within the software supply chain, including manufacturer Leggett & Platt as well as oil and gas multinational Shell. As a result, some of the businesses ended up paying around $75 to $100 million in ransom to CLOP. 

The interconnected nature of global supply chain networks means that manufacturers can’t prevent every attack. So, the key is to minimise an attack’s impact. The only way to achieve this is by adopting an assume-breach-mindset and implementing risk-based strategies to contain the exposure. 

Towards a “break-glass style” response system with Zero Trust

Ultimately, the onus of mitigating these supply chain risks falls on the customer-facing businesses themselves. This means companies that leverage the manufacturing or production supply chains to market the products to the general consumers.

Businesses today need a proactive “break-glass style” emergency response system across its supply chain. They must implement predefined emergency protocols to prioritise operational continuity. The Zero Trust model is the perfect strategy to establish this practice. 

A Zero Trust security model operates on the principle of “never trust, always verify.” It’s a dynamic security strategy for building cyber resilience, and assumes that threats can exist both outside and inside the network.

At the core of Zero Trust is the principle of least privilege access. Users and devices are granted only the permissions necessary to perform their tasks. This minimises the attack surface by ensuring that even if a system is compromised, the potential damage is limited. 

In practice, Zero Trust means that unauthorised access is blocked at every level. So, it becomes exceedingly difficult for cybercriminals to move laterally across the network. 

5 steps to establishing a Zero Trust architecture

The most effective approach to building a Zero Trust network architecture starts with a 5-step model. 

Step 1: Identify 

Primarily, organisations must identify essential systems required to maintain production during an attack. They must identify where their sensitive data is stored, who accesses it, and how it’s used. This requires a clear and simplified data classification system. 

Step 2: Map 

From there, security teams must map out how the sensitive data flows across the network, between users and resources. In this phase, it’s important to engage stakeholders like application and network architects to create accurate transaction flow maps. This is crucial for effective data security.

With this knowledge, security teams can now start implementing Zero Trust Segmentation (ZTS) or microsegmentation technologies.

Step 3: Implement 

ZTS divides networks into isolated segments. Each segment has its own security controls, containing breaches and protecting critical systems. Unlike traditional security methods, ZTS is dynamic. It allows quick, flexible security adjustments, which are essential for protecting hybrid environments. 

This ensures that even if one segment of the supply chain network is compromised, the entire operation isn’t disrupted. In fact, in a recent survey with 1,600 IT and security decision makers, we found that 93% consider ZTS as a critical component to their cloud security strategy.

Step 4: Automate 

The next phase is to establish an automated rule base to enforce access control and inspection policies. Security teams must define rules that strictly limit access to each network segment based on need-to-know principles. All traffic, both internal and external, must be logged and inspected to detect potential threats and identify areas for improvement. 

Step 5: Monitor and maintain

Finally, make sure to continue to monitor and maintain the network. As businesses become more globalised, supply chain networks will only become larger and more complex. Cloud migration and digital transformation will continue in full swing. And for cybercriminals, the attack vectors will only increase. 

However, with Zero Trust in place, attackers can’t force the mass-scale disruption they strive for every time. Shifting to a break-glass style response system with Zero Trust is the only viable way for supply chains to become more resilient.

Securing the software supply chain has become a critical priority due to high-profile breaches and increasing regulatory oversight. International organisations like CISA and NIST stress the urgent need to improve how we inventory and manage the software and services we depend on. 

The growing complexity of modern software systems, coupled with the potential for widespread disruption from a single compromised component, underscores this heightened focus. Recent events, such as the SolarWinds breach, have demonstrated how interconnected systems can be exploited. Similarly, the recent outage related to CrowdStrike’s software update highlights how a single error can rapidly cascade throughout the global economy. 

Regulatory bodies worldwide, including the European Union with its EU Cybersecurity Act, are actively working to address the supply chain vulnerabilities that contribute to these incidents.

As security leaders, we must not overlook a crucial aspect of the software supply chain: cryptography. By establishing comprehensive standards for cryptographic usage, key management, and continuous monitoring, we can more effectively address these challenges.

The Problem: Inadequate Cryptographic Management

Modern software relies on multiple third-party libraries, open-source components, and numerous dependencies. 

This interconnectedness can hide vulnerabilities and create security blind spots, which is also true for these components’ cryptography. According to the Verizon Data Breach Investigations Report (DBIR), leaked credentials—often synonymous with leaked cryptographic keys—are among the most common attack vectors. These machine and workload keys can become compromised due to inadequate key management practices. This then grants attackers unauthorised access to sensitive systems and data.

The lack of automated tooling to efficiently manage the myriad of software components often leaves organisations unaware of the deep security risks associated with their software dependencies. Outdated or insecure libraries, such as those using broken cryptographic algorithms or outdated protocol versions, may be integrated into critical systems. This makes it difficult to fully understand and address the risks posed by poor cryptographic practices in your software supply chains and deployments.

‍Ensuring that third-party vendors adhere to modern cryptography management practices is essential for mitigating these risks. Widespread use of weak cryptography can expose the entire supply chain to catastrophic vulnerabilities. 

The Heartbleed bug in OpenSSL, used by many third-party providers, exposed millions of systems to data breaches, underscoring the need for cryptographic standards and monitoring for them in your supply chain. The Debian OpenSSL bug, where a change in the code led to predictable keys, affecting millions of SSL/TLS keys, highlighted how critical it is to ensure robust and secure implementations. Additionally, regulatory requirements such as HIPAA mandate the encryption of ePHI, with non-compliance leading to significant fines, as seen in the $16 million Anthem Inc. settlement. This highlights the critical need for robust cryptographic management to avoid legal repercussions and ensure compliance.

Mitigating Hidden Threats

There are many vulnerabilities that affect cryptography specifically, from insecure cryptographic libraries and implementations to inadequate monitoring and outdated cryptographic protocol versions. 

Ensuring compliance with good cryptographic management practices, robust key management, and comprehensive reporting are the first line of defence. Regular audits, integrated into procurement processes, help maintain up-to-date and effective cryptographic practices. Continuous scanning and threat intelligence feeds keep organisations ahead of emerging threats. 

Organisations must also stay informed about changes in industry standards and update their practices accordingly to ensure ongoing compliance. Recognising the importance of these practices, the White House’s Executive Order on Improving the Nation’s Cybersecurity has mandated the discovery and inventory of cryptographic keys to bolster software supply chain security.

Operational Continuity is another critical aspect of securing the software supply chain. Disruptions caused by outdated certificates, cryptographic migration issues, or attacks significantly impact business operations. For example, the Microsoft Teams outage in 2020, caused by an expired certificate, demonstrated how failures in certificate management could take down business-critical services. This incident highlighted the importance of maintaining robust cryptographic management practices to ensure operational resilience and reduce the risk of business disruptions.

Supply chains often involve the exchange of sensitive data and proprietary information between partners. 

Without modern cryptography management measures in place, it is challenging to reduce exposure to cryptographic vulnerabilities or to provide evidence for compliance with cryptography-related guidelines. The Codecov attack in 2021, where attackers manipulated scripts to exfiltrate sensitive data, highlights the necessity of secure cryptographic practices to protect intellectual property and maintain data integrity. 

This breach demonstrated how vulnerabilities in the supply chain could be exploited to access and steal valuable information, emphasising the criticality of having robust cryptographic measures in place.

Robust Key Management

Implementing automated key rotation and revocation processes is essential to reduce the risk of key compromise. However, focusing on last-mile key management is equally important. 

This means ensuring secure key distribution and usage at the endpoint, where credentials and keys are often most vulnerable. Many organisations fall short by focusing solely on “secret sprawl”. They focus too much on centralising keys and credentials but then distribute them across deployments without proper controls. This narrow focus leads to “secret spray,” increasing the risk of key leakage and unauthorised access. A stark example of the consequences of inadequate last-mile key management is the Storm-0558 incident. Chinese hackers were able to forge authentication tokens by exploiting poorly managed cryptographic keys. This breach highlighted how failures in endpoint key management can lead to significant security incidents. It also emphasised the need for robust last-mile key management to close the loop on end-to-end security.

Additionally, employing tools that provide real-time monitoring and alerting for cryptographic missteps and policy violations is crucial. Similarly, requiring vendors to maintain and regularly update Software Bills of Materials (SBOMs) helps ensure transparency of all components. SBOMs provide a detailed inventory of all software components. However, they do not capture the cryptography they use. This makes it hard to identify and address cryptographic vulnerabilities when they become known. 

This is where discovery tools come into play. They help you hold vendors accountable for their security promises by discovering how they use cryptography, and how you use the cryptographic capabilities of their products.

The Approach: Centralised Cryptography Management

Incorporating strong cryptographic management into the heart of software development and operations is essential for overcoming these challenges. 

A centralised cryptography management system ensures that all software components comply with rigorous cryptographic standards. This system should automate key management, continuously monitor cryptographic activities, and ensure adherence to industry regulations and standards.

Final Thoughts

Protecting the software supply chain requires a proactive strategy in cryptographic management. 

Organisations must adopt comprehensive standards, implement effective key management practices, and maintain detailed inventories of cryptographic usage. Continuous monitoring and thorough reporting are equally crucial to ensure ongoing security and compliance.

The supply chain ecosystem within construction is facing significant strain. While most severe impacts from the pandemic are easing, challenges like labour shortages and inflation continue to create ongoing pressure throughout supply chain networks. The latest setback is the anticipated 6% decline in construction output this year, as rising mortgage rates start to take their toll. These issues can lead to delays in the delivery of materials and resources, which, in turn, heavily impact a contractor’s finances if not managed effectively. 

This is where technology could make all the difference. Implementing digital solutions can significantly streamline and optimise their supply chains. Whilst some of these challenges may appear limited to the job site, solving them starts with the estimating and procurement teams, which is where tech can play a main role. 

From our conversations with estimators over the years, it is clear that the construction supply chain can become messy. It can often feel like a jigsaw puzzle. From gaining quotes to syncing service lines with the main contractor it is like trying to find that last puzzle piece that didn’t make the box. That’s where online tendering platforms come in—simplifying everything, and giving you one place to handle bids, quotes, and communications, making it smoother for everyone. 

Here are some top tips for ensuring your supply chain operates smoothly:

Broaden your reach 

As skilled labour continues to be scarce, main contractors must look beyond their usual network for new suppliers. Effective collaboration throughout the project is essential for these new partnerships to thrive. But how? 

Digital tendering platforms, like E1, help mitigate construction delays and disruptions by streamlining project execution. These platforms enable contractors to broadly advertise opportunities and invite new subcontractors to submit quotes, reducing the need for extensive back-and-forth communication.

Keeping your network up-to-date is key to staying ahead. By broadening your list of suppliers, main contractors can enhance their resilience and avoid over-relying on just a few subbies. Additionally, expanding your network will boost your competitiveness. With a wider range of quotes, contractors can offer more competitive pricing, improving your chances of securing the project.

Automate, Centralise, and Collaborate

A centralised digital platform could significantly aid the industry in navigating changes and avoiding disruptions. However, Hackett’s Golden Thread Guidance reveals that over 90% of product manufacturers don’t view digitalisation as a major concern. Too often investments in digital technology are misguided due to a lack of understanding of its potential and implications. This view is likely widespread across our industry.

Effective tendering relies on building strong connections rather than getting bogged down by paperwork. Traditional methods of managing tenders can result in missed opportunities and outdated quotes. 

Collaborative networks provided by digital platforms simplify document management, facilitate seamless teamwork, and enable real-time tracking of quotes. This allows estimators to focus on evaluating actual quotes rather than managing paperwork.

I should clarify that automation doesn’t mean replacing human effort with robots; it means speeding up processes by eliminating repetitive tasks, allowing for estimators to focus on building connections in the industry, as opposed to admin crunching. Automated addenda management reduces the risk of document errors, and digital audit trails offer a clear overview of document distribution, minimising disputes.

Looking Ahead

The ongoing challenges we see within the supply chain sector show it is time for the construction industry to get on board with automation and update how we handle tenders. Similar to other industries, such as law and healthcare, automation cuts out the admin hassle and lets contractors focus on the job at hand. When both subcontractors and main contractors see these benefits, it leads to more accurate quotes. 

We’re not looking for a complete overhaul but rather a gradual move toward smoother, more efficient processes that strengthen relationships. Our goal is to keep the UK and Ireland competitive; and we believe the answer lies in improving teamwork and making project execution smoother by refining our essential supply chains, creating a better industry for everyone.