Defence Supply Chain Cyber Security: More Doors Than You Think

As Defence information moves down the supply chain from primes to subcontractors and sub-subcontractors, it can pass through hundreds of systems, users, interfaces and service providers. Each can expand the attack surface or introduce another access path that must be understood and protected.

The Australian defence industrial base presents a broad and expanding target for malicious cyber activity.

The Expanding Defence Industry Attack Surface

Primes may share sensitive or classified information including drawings, specifications, test results and failure analyses. Their own environments may be mature and extensively assured, but those protections do not automatically follow the information into supplier systems.

Defence information passes through emails, document-management platforms, engineering and manufacturing applications, cloud services, backup environments and end-user devices. These systems are also connected through identities, interfaces, remote access and external service providers.

The attack surface includes the systems, identities, connections and third parties capable of providing a pathway to sensitive or Defence-related information. A vulnerability does not need to exist in the system holding that information. It may exist in another system, account permissions and privileges or services that provide an exploitable pathway.

For smaller suppliers, Information and Communications Technology (ICT) and security responsibilities are often concentrated among relatively few people, spanning manufacturing systems, enterprise resource planning (ERP), content management, infrastructure, desktop support and often limited cyber security capability. Maintaining deep expertise across every discipline can be difficult, particularly where those people also hold operational roles within the business. It is therefore likely that they will engage managed service providers (MSPs) for support.

Managed Service Providers and Third-Party Risk

MSPs can augment internal teams and provide specialist technical capability. This further widens the organisation’s exposure.

The supplier must understand how the provider secures its own environment, how it controls privileged access, and whether its practices align with the supplier’s obligations for handling Defence information that the prime or major supplier will share.

SolarWinds (2020), Kaseya (2021), MOVEit (2023), Okta (2023) and the October 2026 ConnectWise/SkyKick compromise share a common feature. In each case, adversaries exploited a trusted software product, managed service provider or identity provider to reach that supplier’s customers, in most cases through access the customers had legitimately granted. Both criminal groups and state actors use this pathway: Kaseya and MOVEit were the work of ransomware gangs, while SolarWinds was attributed to Russian intelligence. The security challenge therefore extends beyond confirming that technical controls are in place, to assuring the trust relationships around them: who holds delegated administration, what access third parties retain, and whether that access remains under oversight as the supply chain changes.

Foreign adversaries understand these dependencies. Rather than attack a major Defence prime or large Defence subcontractor directly, they may target a supplier or service provider further down the supply chain as an easier route to sensitive information, intellectual property or operational capability.

Australian programs have already been exposed this way. In November 2025, the ABC reported that a group one analyst described as “quite likely” to have links to Iran had published material relating to the Army’s Redback infantry fighting vehicle, after allegedly breaching a mechanical parts contractor in the supply chain of Elbit Systems, which supplies the vehicle’s turrets. In a separate incident, a ransomware group claimed to have spent five months inside the systems of Australian firm IKAD Engineering, releasing files whose names reportedly referenced submarine programs. In neither case was a prime’s own network reported as breached.

What Executives Must Know About Pathways and Visibility

For executives, the key issue is whether the organisation understands its actual exposure and the access paths into it. Confirming that cyber controls exist is only the starting point. They must be able to answer: which systems hold or can access Defence information? Which systems provide a pathway to them? Who administers them? Which third parties hold privileged access? Where is information copied, transmitted or backed up?

As people, systems, cloud services, suppliers and business processes change, the organisation’s exposure changes with them. These are areas the Defence Industry Security Program (DISP) expects members to manage on an ongoing basis.

Meeting DISP and ASDEFCON Obligations

ASDEFCON (Australian Standard for Defence Contracting) is the suite of tender and contract templates Defence uses for its procurements. Primes must flow specified ASDEFCON obligations down into their subcontracts, and the security requirements apply to subcontractors with access to classified information or Defence premises. A supplier several tiers removed from Defence can therefore still be contractually bound, although its specific obligations are set by its own subcontract.

Under ASDEFCON, a prime remains responsible to Defence for all of its subcontractors (clause 11.7.2, or equivalent). DISP members must also maintain security risk management arrangements, and Defence considers their reliance on supply chains when assessing suitability for membership (DSPF Control 16.1).

What Smaller Defence Suppliers Can Do

Smaller suppliers do not need to maintain every specialist capability internally, but they do need access to sufficient expertise to understand their changing exposure, assess the controls around it and give executives credible assurance that their Defence security obligations continue to be met.