IBM's X-Force Threat Intelligence Index 2026 has revealed a data point that should fundamentally reshape how organizations think about third-party risk: major supply chain and third-party breaches have quadrupled over the past five years. What was once an emerging threat category has become one of the primary attack vectors facing enterprises today, exploiting the implicit trust that organizations extend to vendors, partners, and service providers.

The report documents a parallel trend that compounds the supply chain problem: a 44% year-over-year increase in the exploitation of public-facing applications. These applications — web portals, APIs, customer-facing platforms — represent the integration points between organizations and their digital ecosystems. They are designed to be accessible, which makes them inherently attractive targets. The sophistication of attacks against these surfaces has increased dramatically as attackers combine automated vulnerability scanning with AI-assisted exploitation.

The Salesloft and Drift incidents cited in the X-Force report illustrate the cascading nature of supply chain compromise. In these cases, attackers compromised Drift's OAuth tokens — essentially digital keys that authorize third-party applications to access services on behalf of users — and used those tokens to access Salesforce customer environments. The victims were Salesforce customers who had done nothing wrong; they were hit through the compromise of a trusted integration partner. This indirect attack path is particularly dangerous because it bypasses security controls that organizations have built assuming direct attacks.

IBM's analysts identify a disturbing root cause running beneath many of the incidents analyzed in the 2026 report: lapses in basic cybersecurity hygiene. Even as organizations invest in sophisticated AI-driven security tools, they frequently fail to implement foundational controls consistently at scale. Identity sprawl — the accumulation of user accounts, service accounts, and automated credentials across complex environments — amplifies the impact of simple mistakes. A single misconfigured service account or unrevoked credential from a departed employee can provide the initial foothold an attacker needs.

The X-Force report emphasizes that modern environments are often too complex for manual oversight. The sheer volume of credentials, configurations, and connections that must be maintained makes human-only management untenable. Continuous, automated security practices — including automated credential rotation, continuous compliance scanning, and behavioral monitoring — are no longer optional enhancements but fundamental requirements for operating securely at enterprise scale.

Organizations responding to this report should conduct immediate third-party risk assessments, paying particular attention to vendors with privileged access to their systems. OAuth token audits, supply chain security questionnaires, and vendor security ratings should become standard parts of procurement and renewal processes.