Kaspersky: Lack of IT Security Staff Hinders Mitigating Supply Chain Attacks

Illustration of IT employees (photo: Kaspersky)

JAKARTA - A recent Kaspersky study has revealed that the lack of qualified IT security personnel and the security priority stack are the main obstacles for organizations in facing supply chain attacks.

In the study, Kaspersky noted that almost half of respondents (42%) admitted that these two factors make the risk from third parties and trusted relationships more difficult to control.

The severity and frequency of these attacks drive the need to identify the key barriers that make organizations struggle to effectively address them.

In the Asia Pacific market, the percentage of organizations citing a lack of qualified IT security staff ranges from 34% in Singapore to 57% in Vietnam.

This reflects the fact that security teams are handling too many tasks at once, which may lead to unaddressed supply chain threats.

Beyond resource constraints, the survey also found structural problems. In Asia Pacific, between 30% and 61% of respondents reported that cooperation contracts do not have IT security obligations for contractors.

This shows that many organizations are still operating without clear security requirements for third parties. In addition, around 25% to 38% of respondents said that non-IT security staff often do not fully understand the risks.

Globally, 85% of businesses acknowledge their organizations need to improve protection against supply chain risks and trusted relationships. However, only 15% of companies assess current security measures to be effective.

Trust levels are even lower in a number of major economies such as Germany (6%), Turkey (7%), Italy (8%), Brazil (8%), Russia (8%), and Saudi Arabia (9%).

In Asia Pacific, trust levels vary. India (11%), Indonesia (14%), and Singapore (14%) reported low levels of trust in existing protections. Meanwhile, Vietnam (21%) and China (34%) showed higher levels of trust.

"When security teams are overwhelmed, understaffed, and have to prioritize urgent tasks over long-term resilience priorities, organizations are vulnerable to threats that can move silently through their provider ecosystems," said Sergey Soldatov, Head of the Security Operations Center at Kaspersky.

To break this cycle, the industry needs to adopt more integrated and consistent mitigation strategies, from standardized contractor assessments to stronger cross-team awareness.

"Supply chain security must be a shared responsibility that can be enforced across the entire business network," he said.