Supply chain risk in IT is not a background concern anymore with 27% of organizations relying on third parties that are not actively monitored in 2023, even as software dependency vulnerabilities keep accumulating. At the same time, many teams still lack the basic building blocks for control, like centralized IT and OT asset inventories and dependable visibility into vendors and subcontractors. The result is a striking gap between how quickly modern systems change and how slowly security assurance can keep up, with costs and incidents that follow when that mismatch hits production.
Key Takeaways
- 27% of organizations reported using third-party providers that are not actively monitored in 2023, increasing IT supply chain risk exposure (from vendors, integrators, and managed service providers).
- 25% of organizations do not maintain centralized asset inventories for IT/OT devices (inventory/control gap).
- 55% of organizations cite a lack of visibility into vendors/subcontractors as a primary challenge in managing third-party risk in 2023 (visibility gap).
- USD 13.0 million average cost of a data breach in 2023 reported globally (resource allocation affects vendor and supply chain security investments).
- USD 9.2 million average time-weighted compliance cost for regulated organizations to implement security requirements for third parties (reported in a 2023 compliance cost assessment).
- 53% of software supply chain practitioners reported that SBOM adoption is increasing, with 31% already using SBOMs in production in 2024 survey results.
- 3.9% year-over-year increase in global IT services revenue in 2024, reflecting demand for outsourcing/integration amid supply chain change.
- 16% of organizations said they have fully implemented digital product passports to improve traceability for products in circulation (traceability in supply chains).
- USD 204.7 billion is forecast global spending on cloud security in 2024 (driving vendor demand for secure supply chain controls).
- USD 68.4 billion global spend on application security testing tools is forecast for 2024, supporting secure development and supplier assurance practices.
- 19% of IT spending is estimated to be for cybersecurity and risk management activities (share of IT budgets supporting supply chain security).
- 36% of organizations have deployed automated vulnerability management in CI/CD pipelines in 2024 (improves supply chain remediation speed).
- 39% of organizations require a security incident response plan from vendors, indicating formalization of IT vendor security obligations in 2023 surveys.
- 33% of organizations report using continuous vendor monitoring tools (automated signals for third-party changes) in 2024.
- 23% of organizations report that lead time for changes is under one day (accelerated delivery that heightens importance of secure supply chain controls).
Many firms lack visibility and monitoring across IT vendor chains, boosting security breach and patching risk.
Related reading
01 · Category
Risk & Compliance9 stats
01
27% of organizations reported using third-party providers that are not actively monitored in 2023, increasing IT supply chain risk exposure (from vendors, integrators, and managed service providers).
02
25% of organizations do not maintain centralized asset inventories for IT/OT devices (inventory/control gap).
03
55% of organizations cite a lack of visibility into vendors/subcontractors as a primary challenge in managing third-party risk in 2023 (visibility gap).
04
23.8% of respondents reported that they do not have a process to detect counterfeit/tainted components in their IT supply chain (control gap).
05
97% of Java applications have at least one known vulnerability in their dependency chain at some point, increasing the likelihood of vulnerable IT supply chain artifacts being deployed.
06
US$ 1.2 billion in annual federal procurement spending subject to cybersecurity supply chain requirements in the U.S. (covered by relevant federal cyber procurement rules and compliance scope).
07
1,200+ software supply chain vulnerabilities disclosed in a major public advisory program in 2023 (count metric used by vulnerability disclosure initiatives).
08
46% of organizations report that they lack full visibility into their software components (dependency visibility gap, a key software supply chain challenge).
09
2.1x higher probability of experiencing a security breach when organizations have weak vendor security practices (odds ratio reported in a peer-reviewed or reputable empirical study).
Interpretation
Risk & Compliance Interpretation
With 55% of organizations pointing to a lack of visibility into vendors and subcontractors and 27% relying on third parties that are not actively monitored, the Risk and Compliance landscape in IT supply chains is being driven by major blind spots that leave both software dependencies and vendor practices exposed, even as only 23.8% lack counterfeit detection processes and Java dependency issues remain widespread with 97% of applications containing at least one known vulnerability at some point.
02 · Category
Cost Analysis2 stats
01
USD 13.0 million average cost of a data breach in 2023 reported globally (resource allocation affects vendor and supply chain security investments).
02
USD 9.2 million average time-weighted compliance cost for regulated organizations to implement security requirements for third parties (reported in a 2023 compliance cost assessment).
Interpretation
Cost Analysis Interpretation
In the cost analysis of IT supply chain security, the global average cost of a data breach reached USD 13.0 million in 2023 and regulated organizations faced USD 9.2 million in time weighted compliance costs to implement third party security requirements, showing how both breach exposure and compliance workload can heavily strain budgets.
03 · Category
Industry Trends11 stats
01
53% of software supply chain practitioners reported that SBOM adoption is increasing, with 31% already using SBOMs in production in 2024 survey results.
02
3.9% year-over-year increase in global IT services revenue in 2024, reflecting demand for outsourcing/integration amid supply chain change.
03
16% of organizations said they have fully implemented digital product passports to improve traceability for products in circulation (traceability in supply chains).
04
50% of organizations expect to increase spend on supply chain risk management capabilities in 2024 (budget shift towards controls and monitoring).
05
12% year-over-year growth in cybersecurity spending is forecast for 2024–2025 range in analyst outlooks (driven by supply chain threats and compliance requirements).
06
7.2% decline in global IT hardware shipments year-over-year in a specific recent quarter affected by component constraints (illustrating supply chain volatility).
07
57% of organizations reported experiencing at least one software supply chain incident in the last 12 months, quantifying realized risk (2024).
08
The Common Vulnerabilities and Exposures (CVE) Program assigned 25,000+ CVEs in 2023, illustrating the vulnerability volume that drives supply chain risk through dependencies and third-party components (CVE year total).
09
ISO/IEC 27036-2 adoption expectation: 52% of respondents in a 2023 survey said they planned to implement third-party security requirements aligned to ISO 27036 in the next 12–18 months (implementation planning metric).
10
The 2024 SonicWall Cyber Threat Report recorded 5,607,000 ransomware attacks worldwide in 2023, indicating the threat environment impacting vendor and supply chain security investment decisions (global attack count).
11
IBM X-Force Threat Intelligence reported 1,200+ malicious packages impersonating legitimate software artifacts in 2023 across popular package ecosystems, indicating ongoing dependency poisoning attempts (threat intel count).
Interpretation
Industry Trends Interpretation
Across industry trends in IT supply chains, adoption and investment are accelerating as 57% of organizations reported at least one software supply chain incident in the last 12 months and 50% expect to increase spend on supply chain risk management in 2024, reinforcing a clear shift toward controls, monitoring, and stronger dependency security.
More related reading
04 · Category
Market Size9 stats
01
USD 204.7 billion is forecast global spending on cloud security in 2024 (driving vendor demand for secure supply chain controls).
02
USD 68.4 billion global spend on application security testing tools is forecast for 2024, supporting secure development and supplier assurance practices.
03
19% of IT spending is estimated to be for cybersecurity and risk management activities (share of IT budgets supporting supply chain security).
04
USD 27.5 billion is forecasted for software supply chain security tools in 2025, expanding demand for SBOM/vulnerability management capabilities.
05
USD 51.4 billion is forecast for supply chain visibility solutions in 2024, reflecting demand for end-to-end tracking across IT product lifecycles.
06
USD 34.8 billion is forecast for global managed security services market in 2024 (outsourcing model increases third-party supply chain dependencies).
07
$6.8 billion global market size for Software Composition Analysis (SCA) in 2023, showing sustained commercial demand for dependency-risk management (SCA market).
08
$1.5 trillion U.S. value of federal prime contract awards was recorded in FY 2023 (procurement spend base affecting the IT supply chain ecosystem).
09
$9.5 billion global market size for IT services outsourcing in 2023 was attributed to demand for managed and integrated IT services, increasing reliance on third parties (outsourcing market metric).
Interpretation
Market Size Interpretation
In the Market Size outlook for IT supply chain security, spending is clearly accelerating as cloud security is forecast to reach USD 204.7 billion in 2024 and supply chain visibility solutions are expected to hit USD 51.4 billion the same year, indicating rapidly growing budget allocation toward end to end protection of increasingly complex supplier ecosystems.
05 · Category
User Adoption6 stats
01
36% of organizations have deployed automated vulnerability management in CI/CD pipelines in 2024 (improves supply chain remediation speed).
02
39% of organizations require a security incident response plan from vendors, indicating formalization of IT vendor security obligations in 2023 surveys.
03
33% of organizations report using continuous vendor monitoring tools (automated signals for third-party changes) in 2024.
04
38% of surveyed enterprises report using dual sourcing for critical IT components in 2024 to mitigate supply disruption risk.
05
72% of organizations reported that they use automated scanning to identify vulnerabilities in software dependencies, supporting faster remediation and supplier risk reduction (2024).
06
10.5% of software developers reported having been affected by a supply chain attack through dependency misuse, reflecting workforce exposure to insecure components (developer survey statistic, 2023).
Interpretation
User Adoption Interpretation
On the user adoption front, the most striking trend is that 72% of organizations already use automated scanning for vulnerable software dependencies, showing that organizations are broadly embracing technology-driven defenses that directly reduce supply chain risk.
06 · Category
Performance Metrics7 stats
01
23% of organizations report that lead time for changes is under one day (accelerated delivery that heightens importance of secure supply chain controls).
02
2.5x decrease in mean time to patch known vulnerabilities reported for organizations using continuous patch automation (measured in a benchmark survey).
03
62% of organizations say they can identify the root cause of production incidents in under 1 hour (supports faster containment of supply chain-related issues).
04
1.6x higher on-time delivery rates for suppliers that use forecasting and replenishment analytics (measured in a 2022–2023 supply chain analytics benchmark).
05
46% of respondents said they have a documented process for approving new software components before production use, a control measure affecting dependency intake (2024).
06
Average time to remediate critical vulnerabilities in dependencies was 24 days for organizations surveyed, quantifying remediation latency that affects supply chain risk (2024).
07
5% of organizations reported that they could not identify any software components in their production systems, representing an extreme dependency visibility failure point (2024).
Interpretation
Performance Metrics Interpretation
Performance in the IT supply chain is moving toward speed and control, with 23% of organizations able to deliver changes in under one day and 62% identifying production incident root causes within an hour, while the gap remains stark as only 46% have documented approval processes for new software components and remediation of critical dependency vulnerabilities still averages 24 days.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Priya Chandrasekaran. (2026, February 13). Supply Chain In The Information Technology Industry Statistics. Gitnux. https://gitnux.org/supply-chain-in-the-information-technology-industry-statistics
MLA
Priya Chandrasekaran. "Supply Chain In The Information Technology Industry Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/supply-chain-in-the-information-technology-industry-statistics.
Chicago
Priya Chandrasekaran. 2026. "Supply Chain In The Information Technology Industry Statistics." Gitnux. https://gitnux.org/supply-chain-in-the-information-technology-industry-statistics.
Sources & references
44 datasets cited across this report · attribution is report-level
+14 additional datasets cited (not shown individually)