Your Vendor Is Your Perimeter

A board-level strategic briefing synthesizing the defining lesson of April 2026: the most consequential attacks did not breach organizational perimeters — they arrived through trusted vendors. A vulnerability scanner was compromised twice, reaching a major password manager's distribution. A WordPress plugin's official update delivered a backdoor to 800K installations. A JavaScript library poisoned AI company build infrastructure. A utility vendor breach created supply chain exposure for electricity, gas, and water utilities worldwide. Supply chain attacks have quadrupled over five years (IBM X-Force). 65% of large organizations cite third-party exposure as their greatest resilience barrier (WEF). Four board-level questions address dependency inventory, vendor incident notification, staged update rollouts with integrity verification, and MSP security posture governance.