New BlueVoyant research finds Singapore’s advanced programmes are not preventing the rise in vendor-related cyber breaches.
Singapore organisations are demonstrating some of the strongest third-party cyber risk management (TPRM) maturity levels globally, according to BlueVoyant’s sixth annual State of Supply Chain Defence report.
The report highlights Singapore as leading globally, with 60% of organisations surveyed reporting established or optimised third-party risk management (TPRM) programmes – nearly double the Asia-Pacific average.
The findings position Singapore not only ahead of regional peers but outpacing US markets – traditionally the most mature globally.
Despite strong maturity levels, Singapore organisations continue to face significant exposure, with 93% reporting negative impacts from a supply chain related cyber breach, a sharp rise from 70% in 2024. This increase may reflect both a growing volume of attacks and improved detection capabilities.
As vendor ecosystems expand and operational dependencies deepen, the findings underscore that even the most mature programmes must continue to evolve to keep pace with ongoing supply chain threats.
Key findings for Singapore
• High programme maturity: 60% of organisations report established or optimised TPRM programmes which are the highest in APAC and among the strongest globally.
• Frequent executive briefings: 32% brief senior leaders monthly or more, demonstrating the impact of leadership engagement, enabling faster response and stronger alignment across organisations.
• Persistent supply-chain impact: 48% experienced 2–5 breaches via third parties in the past year; 36% suffered one breach.
• Rising investment and outsourcing trends: Almost all (98% – up from 90% in 2024) of organisations plan to increase TPRM spending in the next 12 months, while 45% outsource analysis of data and results from monitoring.
• AI adoption building momentum: When it comes to AI, 64% identify this technology as best suited for continuous monitoring in the next year, recognising that automation will be essential for maintaining visibility as the attack surface expands.
• Ecosystems expanding: 67% expect their third-party networks to grow by 6–15%; 42% rely on outsourcing remediation and working with vendors on migration plans.
“As one of the leading hubs for technology and innovation in Asia, Singapore continues to set the benchmark for advanced TPRM programmes,” said William Oh, Head of Asia Pacific, BlueVoyant.
“But this year’s findings show that maturity alone doesn’t guarantee protection. Even with the country’s proactive approach, strong frameworks and sustained government–industry collaboration, more than 56% of organisations experienced multiple third-party breaches.
“The challenge has shifted from building these programmes to ensuring they operate effectively day-to-day amid expanding vendor ecosystems.”
“As supply chains grow more complex, tools and collaboration aren’t enough on their own. Organisations need continuous visibility into vendor risk and leadership engagement that drives real accountability,” Oh said.
“We’re seeing increased investment and strong momentum behind AI adoption, but the biggest gains come when third-party cyber risk becomes part of everyday business decisions not just a compliance exercise. That’s where Singapore’s most mature organisations are pulling ahead.”
The State of Supply Chain Defense Report provides a global benchmark for how organisations assess, monitor and remediate cyber risks originating from third-party vendors.
The 2025 study was conducted by independent research firm Opinion Matters, surveying 1,800 C-suite leaders worldwide, including 300 respondents from Singapore. All respondents held responsibilities in cybersecurity, supply-chain oversight or enterprise risk across organisations with over 1,000 employees.
