Software Supply Chain Security for Small Businesses
Short answer: your software supply chain is every app, cloud service, browser extension and update your business relies on, and every one of them is a way in if it’s compromised or over-trusted. For a small business, securing it comes down to four things: know what you’re running, control which apps can reach your Microsoft 365 data, keep everything updated, and retire software that’s out of support.
Software supply chain security sounds like a problem for developers and big tech firms. It isn’t. A ten-person office typically runs dozens of pieces of software: Microsoft 365, accounting and practice management apps, a CRM, file sharing, a password manager, browser extensions, phone apps, and all the small tools someone signed up for once. Each one has access to something. Most were never checked.
Not sure what software can reach your data? Ring 0151 452 3060 and a person picks up.
Why software is a supply chain
When you install software or connect an app, you’re trusting its maker with whatever it can reach. If that maker is compromised, so are you. The best-known example is SolarWinds in 2020, when attackers slipped malicious code into a routine update of the company’s Orion software, and around 18,000 customers installed it through the normal update process. Small businesses face the same risk on a smaller scale, mostly through the apps and add-ons they’ve connected over the years. We look at SolarWinds and other cases in real supply chain attacks.
1. Microsoft 365 app permissions: the one most businesses miss
Every time someone clicks “Accept” on a prompt asking to let an app read their email, calendar or files, that app gets ongoing access to Microsoft 365. Some are legitimate: a scheduling tool, an email signature app. Some aren’t. “Consent phishing” is an attack where a fake app asks for exactly those permissions, and once a user accepts, the attacker can read their mailbox without ever knowing the password. Multi-factor sign-in doesn’t stop it, because the user granted the access themselves.
The fix is a setting: stop users approving apps on their own, and have an admin review requests. Then look at the apps that already have access in your Microsoft 365 tenant and remove anything nobody recognises.
2. Browser extensions
Browser extensions can often read everything on the pages you visit, including web mail, online banking and your CRM. Extensions change hands, get sold, and occasionally get updated with something malicious. Keep an approved short list, block the rest on managed devices, and remove anything that isn’t needed. There’s more in our guide to browser extension risks.
Want your app permissions and extensions reviewed? It’s part of a cyber risk assessment: we list what’s connected, what it can reach, and what to remove. Ring 0151 452 3060.
3. Updates: keep them, but manage them
SolarWinds is sometimes used as an argument for delaying updates. It’s the wrong lesson. Unpatched software is a much bigger and more common risk, which is why Cyber Essentials requires critical and high-risk updates within 14 days of release. The right lesson is to update on a schedule, from official sources, and to limit what any one piece of software can do if it goes wrong: no everyday admin rights, and monitoring that notices unusual behaviour.
4. Retire software that’s out of support
Software past its end of support gets no more security fixes, so every new flaw stays open for good. Windows 10 reached end of support in October 2025, and Windows Server 2016 follows in January 2027. Old versions of Office, accounting packages and line-of-business apps go the same way. Keep a list with end-of-support dates, and plan replacements before the date, not after.
5. Keep a software register
One list of every app and cloud service the business uses, who owns it, what data it holds, and whether multi-factor sign-in is on. It’s the software half of the supplier register, and it’s what makes the rest of this possible. DSIT’s 2025 survey found 43% of UK businesses reported a breach or attack in the previous year. You can’t protect software you don’t know you’re running.
For the suppliers behind the software, see checking your suppliers.
Start with Microsoft 365 app permissions. It’s the most overlooked and quickest to fix. Book fifteen minutes with Eric this week. Ring 0151 452 3060 and a person picks up.
