The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A threat model that stops at your organization’s network misses two important sources of cyber risk: political developments that can shape the timing and targets of cyber activity, and suppliers whose systems, software or services your operations depend on. Put both into the same risk process as other threats: identify critical dependencies, assess how disruption could affect the business, record owners and response options, and rehearse a supplier-compromise scenario. This is preparation for plausible disruption—not a prediction that a particular actor will attack your organization.
How geopolitics changes cyber risk
Geopolitical events can influence which issues threat actors focus on, when campaigns occur and what methods they use. The connection does not mean every political dispute leads to a cyberattack, or that an organization can infer its own likelihood of being targeted from broad incident statistics. It means political context can change the conditions around threats already relevant to your organization—such as disruption, espionage, data theft or account compromise.
ENISA’s 2025 Threat Landscape analyzed 4,875 selected incidents from 1 July 2024 through 30 June 2025, in an EU-focused, threat-centric report. It describes cyber activity aligned with political developments, including state-aligned operations, hacktivism and cyberespionage. Its figures describe the report’s selection and scope; they are not universal probabilities for an individual company.
Recommended Free Tools
ENISA’s 2026 threat-landscape announcement, published 22 September 2026, reports on observed incidents and events from 1 January through 31 December 2025. It records 4,709 hacktivist claims against EU Member States, more than 89% involving DDoS. It also says 57% of incidents affecting or targeting the EU were ideology-driven and nearly 30% were financially motivated; 51% of recorded cases were low-impact DDoS, and 73% of targeted organizations were essential or important entities. These are EU reporting figures, not a forecast for any one organization. In particular, a hacktivist claim should not be read as proof that every claimed event was independently verified or caused significant harm.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use this context to ask whether your exposure changes when political tensions rise: for example, whether a supplier could be disrupted, whether an attacker could exploit a shared service, or whether a provider’s access to sensitive data would create a consequential route into your environment. The question is about your dependencies and consequences—not assigning risk based on a country label alone.
Why suppliers extend the threat model beyond your perimeter
A supplier can create a path to your organization through software updates, administrative access, hosted data, identity services, communications, infrastructure or operational support. A disruption can also affect you without an attacker entering your network: a cloud service, payment processor or essential component may simply become unavailable. If several business functions rely on one provider or a common downstream service, one incident can have a wider impact than the provider relationship alone suggests.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
There is often limited visibility into the full supply ecosystem, including subcontractors and the origins or control of technology. NIST describes cyber supply-chain risk management (C-SCRM) as a resilience capability and explains why securing an organization’s own infrastructure is not enough when suppliers can be targeted as a route to their customers. See NIST IR 8276. ENISA also reports continued supply-chain and third-party targeting in its 2025 landscape.
Map dependencies by business service, not just by vendor name. For each critical function, record the provider, the technology or service it supplies, the data it handles, the access it has, important downstream dependencies, and what would stop working if it were compromised or unavailable. Note concentration as well: two separate vendors may rely on the same underlying platform or region.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Review critical ICT suppliers across five dimensions
For ICT suppliers, NIST SP 1326, Due Diligence Assessment Quick-Start Guide, published 8 July 2026, provides five concrete dimensions for due diligence. Treat them as prompts for evidence and decisions, not as a one-time pass/fail certificate.
| Dimension | Questions to ask | Evidence or decision to record |
|---|---|---|
| Foreign ownership, control or influence | Who owns or controls the supplier? What legal or other relationships could affect its operations, access or ability to serve you? | Document relevant ownership and control information, the service and data involved, and any resulting constraints or mitigations. Do not treat nationality by itself as a risk verdict. |
| Provenance | Where do the product, components, software and services come from? Can the supplier explain their origin and changes across the lifecycle? | Record what is known about component and software origins, update mechanisms and the supplier’s ability to support integrity checks. |
| Resilience | How would the supplier continue or restore the service after a cyber incident or other disruption? What dependencies could affect recovery? | Capture continuity and recovery arrangements, notification expectations, service dependencies and your own fallback or recovery choices. |
| Foundational cyber practices | What security practices protect the supplier’s systems, accounts, data and products? How are weaknesses and incidents handled? | Ask for relevant, supportable information on security controls, vulnerability handling, incident response and notification—not assurances without scope or evidence. |
| Supply-chain tiers | Which subcontractors, component providers or other downstream parties are material to the service? | Record known critical tiers, where visibility ends, and how the supplier will communicate material changes or downstream incidents. |
Scale the depth of review to the service’s importance, the sensitivity of the data, the supplier’s access, concentration and substitutability, and the time you could operate without it. Where a supplier cannot provide visibility, record that as uncertainty and consider whether compensating controls, contractual commitments, a fallback or a different design is warranted.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn findings into enterprise risk records
A supplier questionnaire is not a threat model unless the answers are connected to a scenario, business impact and decision. NIST’s IR 8286A Revision 1, published December 2025, recommends documenting likelihood and impact in risk registers integrated into an enterprise risk profile so risks can be prioritized for response and monitoring.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For each material supplier scenario, record enough detail that security, technology, procurement and business owners can act on it:
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Scenario and dependency: State what could happen—for example, a compromised software update, loss of a hosted service, or exposure of data held by a supplier—and identify the affected service and dependencies.
- Business consequences: Describe effects on operations, customers, safety where relevant, regulatory obligations, confidentiality, integrity and recovery. Distinguish a short interruption from a prolonged or cascading one.
- Likelihood and uncertainty: Assess the scenario using your organization’s risk method and available evidence. Record assumptions and gaps; do not convert regional incident percentages into a company-specific probability.
- Risk owner and response: Name the accountable business owner and the teams responsible for actions. Choose whether to reduce, transfer, accept or avoid the exposure, and document the decision and rationale.
- Monitoring and triggers: Define what change would prompt reassessment, such as a material ownership or service change, a reported incident, new access, a new downstream dependency or deteriorating recovery evidence.
- Recovery objective and proof: Set the operational target for restoring the affected business function and specify how you will verify restored data, software or service integrity before relying on it.
Connect the register to procurement and service changes so it stays current. A supplier’s risk can change when the product, data flows, access, ownership, subcontractors or business criticality changes—not only when the annual review comes around.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose controls for the failure mode they actually address
No single control closes geopolitical or supplier risk. Choose measures based on the pathway and consequence, and account for implementation effort, ongoing review and effects on the business.
| Measure | Risk it can address | What it does not replace |
|---|---|---|
| Phishing-resistant authentication, such as FIDO2 security keys | Can reduce account-compromise pathways that depend on stolen or phished credentials. ENISA’s 2025 report identifies phishing as the dominant intrusion vector in its analyzed reporting. | Supplier visibility, protections against every account attack, service continuity or incident response. It is one control for one pathway. |
| Supplier due diligence and contractual expectations | Can improve visibility into ownership, provenance, security practices, incident notification, continuity and downstream dependencies. | Direct control of a supplier’s environment or guaranteed prevention of compromise. Review the evidence and plan for failure as well as prevention. |
| Dependency reduction and fallback arrangements | Can limit concentration and help a business function continue when a provider or shared service is disrupted. | Immediate recovery unless the fallback is tested, available and able to meet the function’s requirements. |
| Incident response and recovery capabilities | Can improve detection, containment, restoration and validation after compromise or outage. | Advance knowledge of which supplier will fail or prevention of every incident. The plan must account for supplier communication and access constraints. |
ENISA’s 2025 report says phishing accounted for 60% as the dominant intrusion vector and vulnerability exploitation for 21.3% as an initial-access vector within the report’s stated scope and definitions. Those EU-focused report figures help explain why identity and vulnerability controls matter, but they do not show that either pathway is equally likely for every organization. Authentication hardening is useful, but resilience is broader than buying a security product.
Exercise a supplier compromise or disruption
A tabletop exercise tests whether teams can make decisions when supplier assurances are unavailable and facts are incomplete. CISA provides Cybersecurity Scenarios tabletop packages, including Vendor Supply Chain Compromise (August 2024), as well as ransomware, phishing and insider-threat scenarios.
- Choose a critical dependency. Select a supplier whose compromise or outage would materially affect a business service. Use your dependency map and risk register to identify the scenario and participants.
- Set the exercise boundaries. Define the service, assumed incident, exercise duration and decision-makers. Include security, IT or engineering, procurement, legal or privacy, communications, business operations and the supplier-management owner as appropriate.
- Introduce changing information. For example, have participants receive a supplier notice of a suspected compromise, followed by uncertainty about affected data or software, delayed updates, and pressure to keep the service running. Keep the scenario plausible for the dependency rather than treating geopolitical tension as proof of an attack.
- Test decisions and communications. Ask who can disable access or isolate an integration, how the organization will determine affected systems and data, when it will invoke a fallback, what must be reported, and who communicates with customers, regulators or the supplier.
- Test recovery and integrity. Work through how teams restore service, validate software or data before reuse, and continue if the supplier cannot meet its recovery estimate.
- Assign corrective actions. Record decisions that were unclear, missing contacts, unavailable evidence, untested recovery steps and unresolved dependencies. Give each action an owner and due date, then update the risk record and exercise the revised plan.
What resilience means in practice
Geopolitical context belongs in the threat model because it can shape cyber activity; suppliers belong there because they can extend both the attack surface and the impact of disruption. A useful model connects those drivers to specific dependencies, business consequences, accountable owners and tested response options. Resilience is the ability to anticipate, withstand, respond to and recover from disruption—not a promise that attacks can be prevented.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
