Supply Chain Risk: What Manufacturers Need to Know

Supply Chain Risk: What Manufacturers Need to Know

by Dino Busalachi and Craig Duckworth

Applied Sciences & Engineering Economics & Finance KJMVManagement of specific areasKJMV9Distribution and logistics management
🎙 Dino Busalachi and Craig Duckworth 👥 192 📅 July 28, 2026 ⏱ 22 min 👁 14 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

third-party vendorremote accessOT/IT convergenceincident responseasset visibility

Summary

In this episode of the Industrial Cybersecurity Insider podcast, hosts Dino Busalachi and Craig Duckworth discuss recent cyberattacks on two global dairy producers that were breached through third-party vendors. They explore the messy reality of remote access on the plant floor, including cellular modems and unapproved TeamViewer installs, and highlight the lack of visibility into OT assets, noting that a single sensor might only cover 25% of assets. The conversation emphasizes that the root problem is cultural: OT teams often distrust and lock out IT, and CISOs have responsibility without authority. They argue that incident response plans frequently overlook system integrators, and that budget excuses are invalid given record earnings. The hosts recommend that security leaders engage with their top integrators, ask tough questions about vendor access, and ensure comprehensive visibility and segmentation. They conclude by stressing the importance of learning from these incidents and proactively addressing supply chain risks before a breach occurs.

154 words

Critical Evaluation

Value of the Information & Strength of the Argument

The episode provides valuable insights into the practical challenges of securing manufacturing environments, particularly the often-overlooked third-party risk and the cultural barriers between IT and OT. The hosts argue convincingly that the issue is not primarily technical but human, citing examples of OT teams intentionally blocking IT and CISOs lacking authority. They make a strong case for proactive measures, such as involving system integrators in incident response planning and investing in comprehensive visibility. However, the argumentation relies heavily on anecdotal evidence and general industry knowledge, lacking specific data or case studies. The hosts’ experience lends credibility, but the lack of concrete examples or references weakens the overall rigor.

Scientific Rigor, Source Quality, Title Accuracy

The episode does not cite specific sources or studies, relying instead on the hosts’ professional experience and recent news events. The title accurately reflects the content, focusing on supply chain risk in manufacturing. The discussion is practical and grounded in real-world scenarios, but the lack of verifiable references and the reliance on anecdotal evidence limit its scientific rigor. The hosts mention specific technologies and companies (e.g., Clarity, Dragos) but do not provide further details or sources. Overall, the content is informative but not rigorously sourced.

208 words

Title / Content Match

The title accurately reflects the content, focusing on supply chain risks in manufacturing, specifically third-party vendor breaches and remote access vulnerabilities.

Quality & Reliability

6/10

The hosts are experienced professionals in industrial cybersecurity, but the episode is largely anecdotal and lacks verifiable data or references. They discuss recent breaches without naming sources, and the claims about visibility percentages and breach impacts are not substantiated. The discussion is practical but not rigorously scientific.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

Concurring Sources

  • NIST Cybersecurity Framework — Provides guidelines for improving cybersecurity, aligning with the episode's emphasis on proactive measures.
  • IEC 62443 — International standards for industrial automation and control systems security, relevant to OT security best practices.

Dissenting Sources

  • No specific discordant sources found — The episode does not present conflicting viewpoints or cite sources that contradict its claims.

Contribution & Novelties

The episode offers a practical perspective on third-party risk in manufacturing, emphasizing the cultural and organizational challenges that often hinder effective cybersecurity. It provides actionable advice for CISOs, such as engaging with system integrators and asking tough questions about vendor access. The discussion on the lack of visibility and the limitations of single-sensor monitoring is particularly insightful.

Pour aller plus loin :

  • NIST Cybersecurity Framework — A widely used framework for improving cybersecurity posture, relevant to the episode’s recommendations.
  • IEC 62443 — Standards for industrial automation and control systems security, directly applicable to OT environments.
  • MITRE ATT&CK for ICS — A knowledge base of adversary tactics and techniques specific to industrial control systems, useful for understanding attack vectors.

118 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with slightly higher scores in quantity of information and technical level, but lower in reliability. This indicates a balanced but not deeply rigorous discussion, typical of an expert opinion podcast.

Reliability 5/10

💬 No comments were provided for analysis.