A study of more than 60,000 vulnerability-product records reveals why industrial security needs a wider view of supplier exposure.
The study
The researchers examined 60,378 vulnerability-product records in an industrial control systems dataset covering 2012 to 2020. Those records represented 2,327 distinct vulnerability identifiers, 416 vendors and 14,577 affected products. The team developed a System Risk Index that brings together vulnerability characteristics at the vendor level. Their aim was to understand risks that may be difficult to see when each software flaw is considered in isolation. By examining vulnerabilities across multiple products and suppliers, the approach provides a broader perspective on how security weaknesses are distributed throughout industrial technology environments. This allows organisations to consider patterns of exposure that individual vulnerability assessments might overlook.
One finding stands out. Five vendors accounted for 33.3 per cent of disclosed vulnerabilities but more than 60 per cent of the cumulative index. That imbalance does not mean those suppliers will experience an attack. It does suggest that procurement teams and security leaders should pay attention to where exposure accumulates across their technology estates. The concentration also highlights the importance of evaluating supplier dependencies when reviewing cybersecurity priorities, particularly where multiple operational systems rely on products from the same vendors.
Share of disclosed vulnerabilities and of the cumulative System Risk Index held by the five highest-ranked vendors
Source: Enang, Enang and Akpan (2026), Systems, 14(7), 837. Industrial control systems vulnerability data, 2012 to 2020: 60,378 vulnerability-product records covering 2,327 vulnerability identifiers, 416 vendors and 14,577 products. The second bar is drawn at the 60 percent lower bound reported by the study.
Why industrial systems differ
Industrial control systems support physical processes in manufacturing, energy, water and other essential sectors. A disruption may affect operations and safety, not simply access to information. As organisations connect factory equipment with cloud services, remote maintenance and business systems, their operational dependencies become more complicated.
The analysis also found that the diversity of vulnerability types had the strongest association with the constructed risk index (β = 1.25; p < 0.001). The statistical model explained variation in the index, but the findings do not demonstrate that the measure predicts future attacks. The practical lesson is to assess the range and concentration of weaknesses alongside their individual severity.
Questions for boards
For boards, this changes the questions worth asking. Which vendors appear repeatedly across critical processes? Where would one supplier failure affect multiple sites? Are inventories accurate? Who owns decisions about patching, remote access and continuity plans? An organisation may have excellent incident procedures for individual assets yet lack a clear picture of shared dependencies, creating gaps in oversight and response.
Enang’s work across commercial operations, banking transformation and organisational strategy informs his interest in how technical risks become governance problems. Security specialists can identify weaknesses, but leaders must allocate resources, assign accountability and test the consequences of disruption.
The research points towards a more connected form of oversight: one that combines asset inventories, supplier concentration, operational criticality and tested response plans. For organisations running essential systems, the quality of that oversight may matter as much as the speed of an individual patch.
RESEARCH
Enang, I., Enang, I. and Akpan, I. J. (2026). Systems, 14(7), 837.
https://doi.org/10.3390/systems14070837
Dr Imo Enang is a scholar-practitioner, Senior Lecturer and Programme Lead, MSc Project Management (Online), at the University of Greenwich and Founder and CEO of VLV Group, which comprises Ambidexters, ImpactCity and SkillHubs. Further information: imoenang.com.
