258 Days
Two hundred fifty-eight days. That's how long it took, on average, to identify and contain a breach that started with a compromised supplier, according to IBM's 2026 Cost of a Data Breach Report. It's 11 days longer than the average breach, and it ties supply chain compromise for the slowest attack path IBM measured.
Put that on a calendar. A supplier is compromised in January. The people who mean harm ride that trusted connection into its customers' environments through spring and summer. Nobody notices until fall.
Here's the uncomfortable part. In most of these cases, the vendor wasn't unvetted. It passed a review.
It had an approval on file. That approval was accurate the day it was signed. It just stopped being true, and nothing was watching for the moment it did.
Authorization Is a Snapshot
Government and commercial organizations handle this the same way, even if they use different words. A federal system earns an authorization to operate that can last years. A commercial company leans on an annual audit report and a yearly vendor review. Both are point-in-time decisions about a supply chain that changes every week.
Two ideas close that gap. Continuous monitoring means watching what's actually happening in your environment, including your vendors' footprint in it, not what a questionnaire said last spring. Continuous authorization means the decision to trust gets re-evaluated whenever what you're watching changes. The first without the second produces alerts nobody acts on. The second without the first is guesswork.
Neither idea is new. What's new is the cost of skipping them. Supply chain compromise ranked as the second most common initial attack vector in IBM's data, and it added more to breach costs than any other factor the study measured.
The Questionnaire Isn't the Relationship
Most vendor reviews ask what a vendor says it does. Security policies, certifications, incident response plans. Useful, but none of it describes the relationship.
A better question: what can this vendor actually do inside our environment? Map every way a supplier can observe, modify, disable, update, authenticate, decrypt or administer something you own. Support accounts. Update channels. API keys. Remote management. Service accounts nobody's touched in a year. That's the vendor's real control surface, and it's what continuous monitoring should be watching.
This year's incidents show why. Software supply chain attacks keep moving through trusted update mechanisms and maintainer accounts, where a malicious change arrives looking exactly like a legitimate one. Rubrik Zero Labs reviewed hundreds of 2026 supply chain incidents and concluded the threat is mostly an identity compromise that only looks like a software failure. Healthcare breach disclosures this spring followed the same pattern: the entry point sat entirely outside the breached organization, and the attackers didn't force their way in. They used access that was supposed to be there.
When access is legitimate, nothing looks wrong. Watching the control surface is how you notice that
legitimate access started behaving differently.
Who Decided, and Do We Still Know Why?
Two hundred fifty-eight days is long enough for a lot to change on your side too. The engineer who granted that vendor's access moves to another team. The program manager who negotiated the contract leaves. The security lead who accepted a risk exception retires.
Their reasoning usually lives in email threads, meeting notes and memory. When they go, it goes with them. The vendor's access stays.
Continuous authorization depends on continuity. A decision to trust can only be re-evaluated if the original decision, the conditions it rested on and the person accountable for it are still on record and findable. Otherwise every review starts from zero, and the organization relearns its own supply chain
every time someone changes jobs.
Can You Prove What You Knew, and When?
Eventually the notice arrives. A vendor discloses an incident, and leadership asks four questions. What access did they have? Who approved it? Why? And what did we know on each day of that window?
Most organizations answer by stitching a timeline together from inboxes, tickets and spreadsheets, under pressure, after the fact. It's slow, and it's often incomplete.
Point-in-time reconstruction means being able to replay the state of any vendor relationship on any date: the access it had, the risk rating it carried, the evidence behind that rating and the person who signed off. The stakes are rising. As of September 11, 2026, the EU Cyber Resilience Act requires manufacturers of software and connected products sold in the EU to send an early warning within 24 hours of becoming aware of an actively exploited vulnerability. When the clock starts at awareness, knowing exactly what you knew, and when, stops being paperwork and becomes operations.
What It Means for Founders and Investors
Long dwell time is expensive. IBM found breaches lasting longer than 200 days cost an average of $5.65 million, against $4.32 million for those resolved faster. The same report found organizations making extensive use of security AI and automation shortened breach lifecycles by 65 days.
That's a market signal. Buyers are shifting budget from periodic reviews toward continuous assurance, and enterprise and government customers increasingly expect their suppliers to prove posture on demand. For founders, being able to reconstruct your own decisions is becoming part of how deals close.
Closing the Gap
At Scenario Solutions, this is the problem we're working on: connecting an organization's tools, data, governance and institutional knowledge so trust decisions stay current, the reasoning behind them outlives any one person, and any moment can be reconstructed. Because a vendor that passed its review last year is a fact about last year.
Sources
• IBM Cost of a Data Breach Report 2026
• SureCloud: Third-Party Data Breaches Take 258 Days to Contain
• Cycode: What the IBM 2026 Cost of a Data Breach Report Means for Product Security
• eSecurity Planet: IBM 2026 Cost of a Data Breach Report Key Findings
• Rubrik Zero Labs: Software Supply Chain Threat Landscape 2026
• PKWARE: 2026 Data Breaches
By Angelo Sisneros, Founder & CEO of Scenario Solutions