Your Supplier Gets Hacked. Who Signs for the Damage?

In a video interview, I put two hard questions to Andrew Howell. Both times, he said he didn’t know. Those answers say a lot about who carries the risk now.

The first was about fourth parties, the suppliers behind your suppliers. How far should an operator check companies it never chose? “I don’t know, right? This is a hard problem to get your head around,” he says, “because speed is always going to be to the advantage of the attacker.”

The second was about exit. What rules should help customers leave a security platform, including his employer’s? “Yeah, I don’t know,” he says. “This gets into a whole host of other conversations.”

Those two answers expose the gaps at the center of critical infrastructure security. Systems rarely fail inside one company’s walls anymore. They fail along a chain of contractors, cloud providers, managed services and aging machines, and Verizon now finds a third party involved in 48% of breaches. Every link has an owner. But nobody signs for the whole chain.

Howell has spent his career where that problem meets policy. He ran homeland security policy at the U.S. Chamber of Commerce and led the Operational Technology Cybersecurity Coalition, which lobbies on the industrial systems that run power grids and factories. Since January 2025, he has been vice president of government affairs at SentinelOne. The company passed USD1 billion in annual revenue by selling a single security platform that increasingly acts on its own.

So Howell sells part of the answer. The parts he can’t answer fall to the board. Those answers start with what AI has changed.

Obscurity was a control

“What we’ve seen is we’ve seen AI speed up the same attacks that we’ve been seeing for the last 5, 10, 15 years,” Howell says. “What AI has done, in addition to speeding those attacks up, is [it has] exposed new surface areas that were assumed to be obscured by obsolescence. [Before], it wasn’t worth it for attackers to look at some of that legacy technology because it was hard to find.”

The evidence backs him. Verizon’s 2026 Data Breach Investigations Report found that exploiting software flaws has overtaken stolen passwords as the top way attackers get in, a first in the report’s 19 years. In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to remove edge devices, such as routers and firewalls, that vendors no longer patch. Meanwhile, the fixes keep piling up: Microsoft’s October 2026 update, known as Patch Tuesday, covered a record 1,413 vulnerabilities.

For chief information security officers, Howell says, “if you weren’t working 24/7 before, you sure as heck are now.” More work means more hands on it. So who answers when something breaks?

Shared responsibility, single signature

Picture an attack that starts on a contractor’s laptop, moves through a cloud account and ends in an operator’s data. In the 2024 Snowflake campaign, attackers used stolen login details, in several cases taken from contractor computers, to reach data at about 165 customer organizations.

Who owns that risk? Howell starts with managed security service providers (MSSPs), the outside firms many stretched government teams hire to run security. Under a “shared responsibility” model, the customer and the provider each own part of the job. “You’re going to see a lot of stress put on that shared responsibility model,” he says, “so that the customer and the MSSP have to, from the very beginning, understand where one’s responsibility starts and ends.”

I pushed harder: what happens when every party meets its contract and the service still fails? He answered with the org chart instead, predicting that CISOs will stop reporting to chief information officers (CIOs) and gain more direct authority. But that shift is slow. In the IANS and Artico Search 2026 benchmark, 64% of CISOs still report into IT. And a new reporting line still doesn’t put a name on a supplier’s failure.

Singapore has tried a different route. Under changes to its Cybersecurity Act that took effect Oct. 31, 2025, the regulator can make an essential service provider, such as a utility or a telco, responsible for critical systems that a third party owns. The provider must get legally binding commitments from that owner to share security details and meet set standards. The supplier runs the system and the operator signs for it.

A signature needs evidence. That brings up the data problem.

More telemetry, less sight

Telemetry is the stream of logs and alerts that computers and security tools produce. Howell has written that federal agencies are drowning in it.

“We see all of this telemetry, because we produce a lot of it and we share a lot of it,” he says. “And it’s great to have all that information if you can act on it. But if all that information drowns you, then that’s decidedly unhelpful.” His fix is for technology leaders to “work with companies like ours to get the telemetry you need in order to have automation you trust.” That is the sales pitch, stated plainly.

“Humans don’t have the time to rubber stamp. Automation is the rubber stamp.” — Andrew Howell @ SentinelOne

The companies that collect this data also become targets, and SentinelOne knows this firsthand. It disclosed that China-linked hackers scanned its servers and broke into a logistics firm that supplied hardware to its staff. While SentinelOne itself was not breached, that logistics firm was a fourth party for its customers: a supplier they never chose and probably never heard of. Singapore’s Infocomm Media Development Authority (IMDA) cited the case in an advisory warning that attackers now go after security vendors. The defender is a link in the chain too. For chief data officers, that raises a plain question: who owns your security data once it sits in a vendor’s platform, and do you get it back when you leave?

Better data should mean faster decisions. The question then becomes how many of those decisions AI should make alone.

Automation is the rubber stamp

Where should AI act without a human in a hospital or a power grid? Howell ties it to risk. A person should give the go or no-go on changes to the most critical systems. Automation should handle lower-priority systems that are easy to patch. Then he goes further.

“If people believe that humans should be conducting rubber stamps when it comes to security, that’s the fundamental flaw, I think,” he says. “Because humans don’t have the time to rubber stamp. Automation is the rubber stamp.”

That moves accountability to whoever decides what gets automated. Howell says those people must also keep checking that a system they once ranked low priority still is.

Most buyers aren’t ready to let go. In PwC’s 2027 Global Digital Trust Insights survey of 3,934 executives, just 22% would approve fully autonomous AI agents for cyber defense. SentinelOne’s own governed response feature lets customers decide where its AI must stop and wait for a person.

The more a company lets one platform act for it, the more it depends on that platform.

The defender is a dependency

In July 2024, a faulty update from CrowdStrike, a SentinelOne rival, crashed about 8.5 million Windows computers. Insurer Parametrix estimated USD5.4 billion in direct losses for Fortune 500 companies alone.

Howell trusts markets to punish weak suppliers. “Frankly, I think the market does a pretty good job of punishing third parties when they are identified as being the source of a breach,” he says. “And so I don’t know that you need to do much more.”

The record is less reassuring. CrowdStrike’s shares fell sharply, then later hit an all-time high. A study of 3,316 breaches at U.S. public companies found the average hit to a company’s stock gone within a month. Investors forgive fast. The hospitals, banks and airlines hit by the outage absorbed the losses.

On exit rights, the coalition Howell once led argued against proprietary lock-in, meaning technology that traps customers with one vendor. Europe has turned that idea into law. Under its Digital Operational Resilience Act (DORA), regulators named 19 critical technology providers to the financial sector, and banks and insurers must keep tested exit strategies for critical services.

Rules like these need governments to do their part. There, Howell is most skeptical.

Government owes more than an inbox

If operators must report cyber incidents fast, what should government give back? “I think it’s hard to say, looking back over the last 20, 25 years, that there is an effective way to have a quid pro quo with government,” Howell says. “In my experience, you’re only going to get so much.”

The U.S. record supports him. CISA missed its October 2025 deadline to finalize its incident reporting rule and sent it for White House review only on Oct. 1, 2026. The 2015 law that protects companies when they share threat data lapsed in 2025 and now survives on short extensions.

“It wasn’t worth it for attackers to look at some of that legacy technology because it was hard to find.” — Andrew Howell @ SentinelOne

Singapore offers a different model. When UNC3886, a China-linked hacking group, targeted the country’s four major telcos, the government sent more than 100 defenders from six agencies to work alongside the operators for 11 months. That is reciprocity measured in people, not paperwork.

Whatever the government gives, the first moves belong to the operator.

What to do on Monday

Howell’s advice to a board starts with two briefings. The first covers basic hygiene: the routine controls such as patching and multifactor authentication (MFA), which asks for a second proof of identity at login. Change Healthcare was breached through a remote access portal without MFA.

The second covers third-party risk. “If you have to do one thing on Monday morning,” he says, “it is go in and talk to your CEO and your CIO.” The goal is to learn which suppliers the business depends on, and whether their security adds to its risk or reduces it.

Add three steps of your own.

• Map the chain: Start with your critical suppliers, then ask who they depend on. Only a third of organizations fully map their supply chains, the World Economic Forum found.
• Write down the automation line: List what AI may do alone, and have a named executive, such as the chief AI officer or the CISO, sign off on it. Review the list every quarter.
• Rehearse leaving your security platform: Ask how long a move would take and what detection rules and case history you can take with you.

Howell’s two blanks point to the same place. No vendor can tell you how far your checks must reach or how fast you can leave a supplier. Those answers belong to the board. So when a supplier gets hacked, the board signs for the damage either way. Better to sign knowing what it covers.

Image credit: iStockphoto/eagreez