Threat-landscape dependencies belong in resilience planning
Threat-landscape dependencies belong in resilience planning The 2026 ENISA Threat Landscape analyzes incidents observed from January through December 2025. It reports that ransomware remains the most immediately disrup
Threat-landscape dependencies belong in resilience planning
The 2026 ENISA Threat Landscape analyzes incidents observed from January through December 2025. It reports that ransomware remains the most immediately disruptive incident type, public administration remains the most targeted sector, and geopolitical developments continue to influence hacktivist DDoS activity. The report also states that increasing digital interdependence expands the attack surface and weakens resilience when a shared dependency fails.
A dependency view changes the unit of planning. An organization may protect its own application and still lose service because a payment processor, identity provider, cloud region, domain registrar, or telecommunications link is unavailable. The same dependency can also become a common-mode failure across many organizations.
Build a dependency graph with an owner
Start with the services the organization needs to deliver a critical outcome. For each service, record the internal platforms, external providers, network paths, identity services, certificate authorities, data sources, and recovery tools it depends on. Assign an owner to each dependency and record the contract or operational contact that can confirm status.
The graph should show direction. A SaaS provider may depend on a cloud region, while the organization depends on the provider's API for authentication and its support portal for recovery. A single upstream outage can remove both the production path and the path used to manage the incident.
Test shared and local failure
Tabletop exercises often assume the organization's own primary system fails while every supplier remains available. Add a scenario in which the identity provider, DNS service, and a key supplier fail together. Ask which manual process exists, who can approve it, and how long it remains safe.
Review shared credentials and shared trust anchors. A code-signing service used by many product teams can become a common source of trust. A monitoring agent deployed across every host can become a common source of blindness. A contractor account used by several support providers can become a common access path.
Measure recovery in dependency terms
A recovery point objective for a database is incomplete if the backup keys are held by a provider that is also unavailable. Record the recovery sequence, including the people, identities, certificates, and support channels needed at each step. Test at least one step that depends on a supplier-controlled system.
Track concentration. If most critical applications rely on one cloud region, one identity provider, or one network carrier, document the concentration and the compensating controls. The goal is not to eliminate every dependency. It is to understand which failure would exceed the organization's tolerance and to prepare a decision before it happens.
Use threat reporting as a review prompt
ENISA's findings can guide questions rather than prescribe a local risk score. Ransomware raises questions about backup isolation, recovery authority, and the ability to restore without the primary identity system. DDoS against public administration raises questions about capacity, upstream filtering, and offline communication. AI-assisted operations raise questions about credential exposure and automated response limits.
Map each question to an owned control and an evidence source. If the answer is a vendor assurance statement, record the scope and date. If the answer is an internal test, keep the result and the assumptions. A dependency review that produces only a list of suppliers will not change response behavior.
Plan for the degraded state
The most useful resilience work defines what the organization will do when a dependency is unavailable, untrusted, or partially degraded. That may mean a read-only service, a manual approval path, a reduced transaction set, or a temporary alternate provider. Each option needs a security review because degraded modes often remove authentication, logging, or rate limits.
Interdependence is a property of the operating environment, not a rare exception. Resilience planning should show where the organization is exposed to a shared failure, who can make the degraded-mode decision, and what evidence will confirm when normal service can resume.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.