Ransomware in Europe: Third-Party Supplier Risk or Regulatory Failure?

Darren Cho: Containment is the Only Effective Response

The troubling rise in ransomware incidents against European organizations, particularly via third-party suppliers, signals a critical need for improved containment and incident response strategies. As an expert in incident response, I believe the emphasis should be placed on how organizations can effectively triage and manage breaches once they occur. The data showing a 55.1% increase in publicly disclosed incidents highlights a systemic vulnerability within protocols for responding to security events, particularly when third-party suppliers are involved. Companies should prioritize creating robust incident response (IR) workflows that enable rapid containment of attacks to mitigate damage.

While regulations like NIS2 and DORA are essential to foster accountability among organizations, they often focus more on compliance than on the actions that need to be taken in the heat of a crisis. The immediate fallout of a ransomware incident is not merely about reporting obligations; it’s about the response capacity of the affected organization. If Europe is to stand against these attacks, firms need to invest meaningfully in their IR capabilities and not just rely on regulations that often lag behind the evolving landscape of threats.

Regulations will not tame the adversaries targeting these vulnerable third-party suppliers. It’s the organizations themselves that must ensure rigorous training and preparedness so that when the inevitable happens, they can act decisively. We need to lead with IR workflows that prioritize response over compliance to stem both damage and liability when an attack strikes.

Ivan Sorrell: Technology is the Core of the Threat

From a technical standpoint, the increase in ransomware incidences via third-party suppliers is an unavoidable result of the adversaries' evolving tactics, and this shifts the focus back to exploit development and the tradecraft of these malicious actors. Simply put, as organizations tighten their security measures, attackers will adapt. They view third-party suppliers as lucrative entry points—often with weaker defenses. This cycle of attack and adaptation is why the technical arms race between cybersecurity professionals and cyber adversaries will never cease.

The real issue is the failure to recognize the sophistication of the adversaries we face rather than merely amplifying regulatory responses. Regulations are important, but they are often reactive rather than proactive. We must instead channel energy into understanding the technical landscape and how vulnerabilities become points of exploitation in the supply chain. Organizations need to invest in threat intelligence and advanced security tools that can better predict and counteract these advanced persistent threats, reducing third-party risk significantly.

Until firms embed exploitation perspectives into their security strategies—understanding how attackers maneuver within their systems—regulatory compliance alone won't help. Yes, laws are beneficial, but the weakest link in the chain will always be the third-party suppliers with insufficient defenses; thus, attention must be directed at these technical aspects if we hope to secure the overall ecosystem effectively.

Leah Sterling: Regulatory Frameworks Must Address Privacy Risks

Third-party suppliers undeniably represent a significant risk vector for ransomware attacks, and the regulations currently being enforced—like NIS2 and DORA—must evolve to comprehensively address privacy implications rather than merely focus on cybersecurity measures. As an advocate for privacy law and its intersection with cybersecurity, I contend that the enforcement of regulations without considering surveillance risk and user privacy means a critical gap remains. Regulations should not come at the cost of user rights and civil liberties.

The personal data breaches caused by third-party compromises, as seen in the alarming incident affecting over a million individuals, would not only have reputational damages but could also lead to legal repercussions under laws such as GDPR. Therefore, it is necessary for organizations to evaluate their risk management processes not solely for cybersecurity but for data protection as well. Securing the supply chain means understanding and mitigating the compounded risks that arise from these relationships.

If cybersecurity regulations ignore the implications on privacy, we risk creating an environment where organizations may check boxes to meet compliance without any substantive actions toward the privacy of individuals whose data they manage. We must strike a balance between imposing rigorous security requirements and protecting the rights of users whose information is often in the balance.

Mara Bell: Risk Management Needs to be Holistic

The apparent disconnect between regulations and actual effectiveness in managing cyber risks highlights a broader failing in risk management strategies at the organizational level. While I appreciate the robust frameworks being introduced, they often lack practical enforcement mechanisms that ensure companies take the requirements seriously, particularly with respect to their supply chains. As organizations grapple with compliance to new laws, they often overlook the broader implications of their risk management systems, particularly the cascading effects of a single third-party breach.

My concern circles back to the efficacy of both regulatory frameworks and company policies in responding to ransomware threats through third-party suppliers. For firms to address the current vulnerabilities effectively, they must commit to holistic risk management practices that incorporate not just cybersecurity measures but also board-level responsibility and accountability. Underestimating the potential damages from a supply chain breach may lead to inadequate preparation, hampering a timely recovery from attacks.

As much as regulations can enforce standards, they cannot guarantee adherence unless organizations infuse risk management into their culture from the top down. Training, awareness, and effective breach disclosures should also be prerequisites, and organizations should treat these vulnerabilities not just as compliance issues, but as fundamental components of their operational integrity.

Noa Keller: The Need for Better Threat Intelligence

At the intersection of understanding threats and managing risk lies the critical need for more robust threat intelligence. The lack of high-quality reporting and verification presents a significant gap in the cybersecurity narrative around ransomware and third-party suppliers. In analyzing recent incidents, many organizations have not prioritized the quality of threat intel, which trickles down into how they assess risks associated with their suppliers.

While the emphasis is currently on regulatory compliance and breach disclosure, without a reliable framework for threat intelligence validation, organizations remain susceptible to miscalculations about their exposure or the legitimacy of reported threats. This can lead to either overreaction or complacency in a landscape that demands agility and precision. The risk of ransomware through third-party suppliers can be mitigated through better intelligence, yet many firms still operate in silos, ignoring the vast data available to them.

The challenge is to elevate the discourse around threat intelligence and reporting quality within organizations. Ransomware gangs are innovative and will likely continue to exploit weaknesses in the supply chain. Thus, if organizations want to stay ahead, they must foster a culture of rigorous scrutiny over threat data and integrate it effectively into their assessments of supplier risk, in tandem with the proposed regulatory frameworks.

In summary, while the roundtable participants agree on the critical threat posed by third-party suppliers in ransomware attacks, their responses diverge significantly. Darren Cho emphasizes the need for robust incident response capabilities, suggesting that regulation is insufficient without practical IR frameworks. Ivan Sorrell adds that technical understanding of adversaries and exploit development is crucial, arguing that regulations alone will not deter evolved threats. Leah Sterling focuses on the necessity of intertwining privacy considerations with cybersecurity regulations, asserting that regulatory measures cannot undermine user rights. Mara Bell calls for holistic risk management that integrates compliance with operational practices, arguing that accountability must stem from the top. Finally, Noa Keller stresses the importance of high-quality threat intelligence in assessing vulnerabilities, saying that organizations need to prioritize accurate threat reporting to avoid a reactive posture in their defenses. The roundtable essentially highlights the complex interplay of compliance, operational capability, and preparedness in the face of an escalating ransomware threat landscape.