Beyond the perimeter: how AI, people, and supply chains are redefining cybersecurity

Artificial Intelligence (AI) is radically transforming the corporate cyber security landscape. However, the greatest challenge does not lie solely in the attacker’s technological sophistication, but in how this capability multiplies the vulnerability of the human factor and expands the attack surface towards the supply chain.

When we analyse AI-driven cyber attacks, we tend to focus on the generation of malicious code or the automated discovery of vulnerabilities at high speed. Whilst AI has drastically lowered the barrier to entry for executing advanced cyber attacks, its true impact lies in its ability to exploit an organisation’s relationships of trust.

As expert Ralph Echemendia points out in a recent interview in La Vanguardia, the accessibility of AI allows any malicious actor to elevate their offensive capabilities without requiring highly specialised knowledge.

In today’s corporate environment, AI does not replace the relevance of the human factor or third-party relationships: it turns them into the primary vector of access.

The third-party ecosystem: the invisible extension of your security perimeter

Traditional cyber security strategies have historically focused on protecting the internal perimeter through controls such as Firewalls, EDR, MFA, Zero Trust, and network segmentation. Although these measures remain indispensable, a modern company’s digital architecture is no longer limited to its own systems.

Organisations operate hyperconnected to cloud environments, SaaS platforms, integrators, consultancy firms, infrastructure and support providers, and multiple outsourced services. Each interconnection represents a legitimate channel of access and, therefore, a potential entry point for cyber criminals.

Suppliers and business partners must be evaluated and managed as a direct extension of the corporate attack surface. It is essential to audit and govern their privilege levels, associated credentials, accessible data, and the operational impact that the compromise of one of their accesses would entail.

Third-Party Risk Management (TPRM): from certification to real visibility

Evaluating a supplier’s security through mere questionnaires or certifications is insufficient. The critical question organisations must answer is: What level of operational and technological risk does this third party introduce into our infrastructure?

Two suppliers with the exact same compliance standards can present radically opposed risk profiles depending on their level of integration:

• Access to public or low-impact data versus direct connections to the corporate ERP or CRM.
• Cloud infrastructure management and identity administration with elevated privileges.
• API integrations with the capacity to execute automated actions and exchange confidential information.

To effectively mitigate this risk, it is necessary to structure a continuous map of dependencies and accesses: Third Party → Permissions → Sensitive Data → Integrations → Business Impact.

AI-Optimised Social Engineering: the human factor in the crosshairs

The human link remains a critically important point in any organisation’s security strategy. Modern cyber attacks rarely seek solely to breach technological defences; in a very high percentage of cases, the true objective is to persuade or manipulate a legitimate user (whether an employee, a systems administrator, HR personnel, or an external supplier) into carrying out an unwanted action: sharing a password, accepting a request, opening a document, authorising a transfer, resetting an account, providing information, approving access.

The integration of generative AI drastically amplifies the scale and sophistication of these threats. Through the automated creation of highly convincing messages, the design of flawless fake identities, and the execution of advanced Phishing, Spear Phishing, and Deepfake campaigns in real-time, cyber criminals manage to eliminate traditional grammatical or contextual errors, tailoring each attack to the victim’s specific profile.

Furthermore, AI profoundly alters the economics of the attack by drastically reducing the technological and financial barriers to entry for attackers.

AI changes the economics of the attack

This is arguably one of the most significant transformations. Previously, certain attacks required high technical knowledge. Today, some of those capabilities can be assisted or automated via AI. This does not mean that just anyone can execute any attack, but it does mean that certain barriers to entry are lowering. And that changes the equation.

The Spanish Data Protection Agency (AEPD) recently reported an incident in Spain where an AI agent was reportedly used to autonomously chain together different phases of an attack against a real system. The AEPD itself warns that the information comes from the notification of the affected organisation and must be analysed before drawing definitive conclusions, but considers the case a sign that AI-supported attacks are no longer solely a theoretical risk (Cinco Días).

The question is how the scale, speed, and sophistication of those attacks will change.

The new economics of cybercrime and the need for orchestration

The integration of autonomous agents and AI tools significantly reduces the execution time of the phases of an attack. Faced with this acceleration of threats, the solution does not lie in the mere disordered accumulation of more cyber security tools, which usually generates alert fatigue and severe visibility gaps. 

The fundamental requirement is to provide defence with context and orchestration capability, raising key auditing questions such as:

• What level of real risk does each solution and integration introduce into our infrastructure?
• Do we have unified visibility over permissions and data accessible by third parties?
• Can we detect and respond to anomalous or automated behaviours in real-time?

The attack surface is no longer a perimeter

Our attack surface is made up of our technology, our data, our identities, our suppliers, our integrations, and above all, the relationships of trust connecting all those elements.

AI is making that surface even more dynamic. That is why we also need to change our way of thinking. It is not enough to protect the company; we have to protect the company’s ecosystem of trust. And that means getting to know our suppliers, understanding the risk each one introduces, limiting their privileges, controlling their accesses, and being able to detect anomalous behaviours.

But it also means preparing people. Because the attacker’s objective will not always be to find a vulnerability in our software. Sometimes it will be to get someone to open the door for them. Technology can be the door, the supplier can be the path to the door, but often it will be a person who, without knowing it, ends up opening it.

In the era of AI, that person may be facing an attacker who has more capacity, more speed, and more resources than ever before. The future of cyber security will not simply consist of defending systems. It will consist of managing trust.

A2SECURE: visibility, continuous risk management and comprehensive ecosystem protection

At A2SECURE, we support organisations in the comprehensive protection of this ecosystem of trust through a proactive approach of visibility, continuous monitoring, and risk management across the supply chain and the human factor.

Our value proposition combines advanced managed cyber security services, third-party risk audits, and awareness programmes designed to strengthen corporate resilience and transform security into a business enabler.

Modern cyber security demands evolving from perimetral control to the intelligent and continuous management of trust. Contact our team of experts at A2SECURE to evaluate the maturity of your security strategy and protect your most critical assets against emerging AI-driven threats.