By James Yang , Executive Assistant to the CEO, Profet AI
A Highly Connected Supply Chain with Increasingly Blurred Cybersecurity Boundaries
In our previous article, we explored the cybersecurity concerns surrounding the adoption of AI in the semiconductor industry. This time, we turn our attention to semiconductor supply chain security and examine why cybersecurity has become increasingly important to maintaining operational resilience and competitive advantage across a highly complex and interconnected supply chain.
Every stage of semiconductor manufacturing relies on technologies, equipment, data, and services provided by different organizations. This high degree of specialization enables the industry to maintain its enormous production scale and efficiency, but it also makes enterprise cybersecurity boundaries increasingly difficult to define.
In the past, enterprise cybersecurity largely focused on protecting an organization’s own networks, devices, and systems. Today, however, external suppliers may have remote access, third-party software may connect to internal systems, SaaS platforms may integrate with enterprise data through APIs, and suppliers themselves may depend on additional third parties.
As a result, the scope that organizations need to manage has extended far beyond their own IT environments.
If one node in this ecosystem is compromised, attackers may leverage existing trust relationships and access privileges to introduce risk into the enterprise—and potentially into other organizations as well.
For the semiconductor industry, supply chain security is therefore no longer simply an additional component of supplier management. It is increasingly becoming part of enterprise operational resilience.
The Supply Chain Is Becoming a New Attack Surface
This is not merely a hypothetical scenario.
In 2025, SecurityScorecard, a company specializing in cybersecurity risk assessment and supply chain security, surveyed nearly 550 cybersecurity leaders responsible for security strategy and management. More than 70% of respondents reported that their organizations had experienced at least one significant third-party cybersecurity incident in the previous year. The research also indicated that fewer than half of organizations were able to monitor the cybersecurity posture of more than 50% of their extended supply chain.
This highlights a challenge beyond the increasing number of third-party incidents: organizations may not have complete visibility into the risks across their own supply chains.
SecurityScorecard’s follow-up research in 2026 further found that 78% of respondents said their organization’s supply chain security programs covered less than half of their supplier ecosystem.
As the number of suppliers, services, and digital connections continues to grow, organizations’ ability to oversee these relationships may not expand at the same pace. The supply chain can therefore become a risk network that is increasingly difficult for an individual organization to fully control.
The npm supply chain attack in September 2025 provides one example.
The incident affected 18 widely used JavaScript packages. According to Unit 42, the threat intelligence team at Palo Alto Networks, these packages collectively accounted for more than 2.6 billion downloads per week. Attackers compromised the account of a package maintainer and injected malicious code into software components that had previously been trusted.
As a result, downstream users could potentially introduce compromised code into their own development or runtime environments simply by installing or updating the affected packages as part of their normal software workflows.
What makes this incident particularly significant is not only that third-party software was compromised, but that attackers exploited trust within the supply chain.
Downstream organizations did not directly interact with the attackers. They simply used software components they already trusted, yet that trust could potentially make them part of the attack chain.
A similar challenge can arise from integrations between SaaS platforms and third-party applications.
In November 2025, Salesforce identified suspicious activity associated with connections to the Gainsight application. The connections may have enabled unauthorized access to certain customer data. Salesforce subsequently revoked the application’s access and stated that there was no indication that the incident originated from a vulnerability in the Salesforce core platform itself.
The incident illustrates that supply chain security risks do not necessarily originate from a supplier’s own products or systems. They can also emerge from integrations, trust relationships, and access privileges between an enterprise and its third-party applications.
Attackers do not always need to directly breach an organization’s core platform. They may instead look for attack paths through third-party connections that already have legitimate access.
Together, these cases highlight a fundamental point:
Attackers do not necessarily need to break through an organization’s defenses directly. They may instead exploit trust, integrations, and access privileges between the organization and its third parties.
Greater Cybersecurity Complexity in the Semiconductor Supply Chain
The challenge becomes even more complex in the semiconductor industry.
Semiconductor manufacturing relies heavily on equipment manufacturers, material suppliers, engineering service providers, and software vendors. Manufacturing equipment itself may involve operating systems, applications, network connectivity, remote maintenance, and data exchange.
In other words, a single piece of equipment may connect not just to one supplier, but to an entire ecosystem of organizations, systems, and services.
As discussed in our previous article, the semiconductor industry has already established SEMI E187, a cybersecurity standard for semiconductor manufacturing equipment.
In addition, in 2025, Taiwan’s Ministry of Digital Affairs worked with industry partners including SEMI, TSMC, and ASE to promote a verification framework based on the SEMI E187 semiconductor equipment cybersecurity standard. The framework was formally implemented in 2026, further establishing a third-party verification mechanism for equipment cybersecurity.
This represents a shift from security requirements defined by individual organizations toward industry-wide verification and trust mechanisms.
However, having a standard does not mean that the entire supply chain is secure.
SEMI E187 primarily focuses on semiconductor manufacturing equipment. In practice, organizations also face supply chain risks involving third-party services, remote maintenance, SaaS platforms, APIs, software components, supplier accounts, and suppliers’ own third-party dependencies.
Therefore, while SEMI E187 provides an important foundation for semiconductor supply chain security, it should not be treated as equivalent to comprehensive supply chain security governance.
A standard addresses “what should be done.”
Governance must go further and address “who is responsible, how it should be verified, how often it should be reviewed, and what should happen when the risk changes.”
Traditionally, organizations have approached supply chain security through supplier management, using questionnaires, audits, certifications, and contractual requirements to determine whether third parties meet defined security standards.
These mechanisms remain important.
However, as supply chains increasingly extend into suppliers’ own third parties, software components, SaaS platforms, APIs, and digital integrations, organizations need visibility beyond the security posture of individual suppliers.
They need to understand the critical dependencies, high-risk nodes, and pathways through which risk can propagate across organizations and systems.
“Requiring Security” Does Not Mean “Being Secure”
This leads to one of the most practical challenges in supply chain security.
From the customer’s perspective, an organization may manage a large number of suppliers, each with different roles, access privileges, data exposure, and business criticality.
If every supplier is subject to the same cybersecurity requirements, organizations may need to invest significant resources in questionnaires, audits, and follow-up activities. At the same time, genuinely high-risk suppliers may become difficult to identify amid large volumes of lower-risk information.
The real question is therefore not simply:
“How many suppliers do we need to manage?”
It is:
“Which suppliers have the highest-risk connections to our critical assets, systems, equipment, and operations?”
For example, a supplier providing general materials and a maintenance provider with remote access to manufacturing equipment clearly present different levels and types of risk.
Likewise, an account with access only to general information should not necessarily be managed in the same way as a privileged account capable of accessing sensitive R&D data.
From the supplier’s perspective, cybersecurity requirements also have practical limitations.
For some small and medium-sized suppliers, additional security requirements may require significant investments in personnel, technology, and ongoing maintenance. When different customers impose different questionnaires, certifications, and security controls, suppliers may need to devote substantial resources to compliance activities without necessarily achieving a proportional reduction in actual risk.
Supply chain security therefore cannot simply mean that customers continuously add requirements and shift the responsibility and cost downstream to suppliers.
A more mature governance approach should align security requirements with the actual risks associated with each supplier, while establishing clear mechanisms for verification and continuous improvement.
Three Shifts in Supply Chain Security
1. From Point-in-Time Audits to Continuous Risk Management
One-time supplier questionnaires and audits still have value. They can help determine whether a supplier has established baseline controls and can serve as important references for procurement and contract management.
However, they cannot represent a supplier’s security posture several months—or several years—into the future.
Supplier systems may be upgraded, accounts and privileges may expand, remote maintenance practices may change, and the supplier’s own third parties may experience cybersecurity incidents.
The U.S. National Institute of Standards and Technology (NIST) describes Cybersecurity Supply Chain Risk Management (C-SCRM) as a systematic process for identifying, assessing, and mitigating cybersecurity risks throughout the supply chain.
A mature supply chain security program should therefore not rely solely on annual questionnaires or one-time audits. Instead, it should establish a continuous cycle:
Identify dependencies → Assess and control risk → Continuously monitor changes → Respond and improve
Audits answer the question:
“Are current requirements being met?”
Continuous risk management goes one step further:
“Has the risk changed?”
2. From Uniform Requirements to Risk-Based Classification
As supply chains become larger and more complex, it becomes increasingly impractical to impose exactly the same cybersecurity controls on every supplier.
Organizations should determine the appropriate level of security management based on factors such as the data, systems, equipment, access privileges, and business criticality associated with each supplier.
Lower-risk suppliers may be subject to simplified assessment and verification processes, while suppliers connected to core manufacturing environments, critical equipment, or sensitive data may require more comprehensive security assessments, access controls, technical verification, and continuous monitoring.
This does not mean lowering security requirements.
Rather, it means directing limited cybersecurity resources toward the areas where the potential impact is greatest.
For organizations, the key metric is not simply how many suppliers they manage, but whether they can clearly identify which suppliers could have a significant impact on critical operations if compromised.
3. From One-Way Requirements to Collaborative Governance
If supply chain security is reduced to “customers telling suppliers what they must do,” it can easily become an exercise in transferring responsibility.
A customer adds cybersecurity requirements to a contract. The supplier submits documentation. Both parties complete an audit. The process appears to be finished—but the underlying risk may remain.
Effective supply chain governance requires customers, suppliers, and relevant service providers to establish clear responsibilities and coordinated response mechanisms.
Which risks are the supplier responsible for mitigating?
Which risks need to be managed jointly?
If a supplier experiences a cybersecurity incident, how quickly must it be reported?
Can the enterprise rapidly revoke access or isolate a connection?
These questions need to be defined before an incident occurs.
Supply chain security is therefore not about requiring every organization to achieve the same maximum security standard.
It is about establishing a governance model that can allocate responsibilities according to risk, continuously verify security conditions, and enable rapid coordination when incidents occur.
From Supplier Management to Supply Chain Governance
As supply chains extend to fourth parties, fifth parties, and beyond, it is not realistic for an organization to have direct visibility into every node.
The maturity of supply chain security should therefore not be measured simply by the number of suppliers an organization manages.
Instead, organizations need to determine whether they can identify critical dependencies, prioritize risks, and understand their exposure and potential impact even when they cannot directly control every part of the ecosystem.
For the semiconductor industry, what needs to be protected is not limited to a single piece of equipment, a single account, or a single supplier.
It also includes the process data, engineering know-how, intellectual property, equipment capabilities, and operational processes accumulated through cross-organizational collaboration.
These valuable assets are distributed across different organizations, systems, and services, and continuously move through equipment, software, people, and data.
The more complex the semiconductor supply chain becomes, the less feasible it is to rely solely on supplier management to ensure security.
The real challenge is to establish a governance framework that connects organizations, systems, and supply chain relationships while continuously identifying and managing risk.
In other words, organizations need to look beyond managing individual suppliers.
They need visibility into critical dependencies, high-risk nodes, access privileges, and data flows, while continuously adapting their security management as risks change.
When organizations move from “managing suppliers” to “governing the supply chain,” cybersecurity is no longer simply about passing requirements and responsibilities down to the next layer.
It becomes about building a governance capability that can identify critical dependencies, continuously monitor risk, and respond rapidly when an issue emerges at any point in the ecosystem.
For the semiconductor industry, the next layer of supply chain security is not simply about requiring every node to be secure.
It is about making the entire ecosystem more transparent, more verifiable, and more resilient.
