Supply Chain Resilience

China controls production and processing of the majority of the world’s critical minerals. Ever wonder how they got there? Or why? And more importantly whether the West can actually catch up—without taking another 20 years? They didn’t stumble into it. They engineered it. A deliberate 100-year industrial strategy, launched by Mao, refined by Deng, and locked in by Xi. Control the inputs—rare earths, graphite, lithium, magnets, battery materials—and you control everything built on top: chips, EVs, missiles, grids, data centres. No shots fired. Just leverage. The West watched, outsourced the messy middle, and woke up dependent. Here’s the part almost no one says out loud: We are not starting from scratch. We already mine. We still have processing know-how, brownfield sites, deep capital markets, trusted partners, and customers desperate for non-Chinese supply. Second-mover advantage is real. China spent decades writing the playbook. We can copy the cost curves, skip their dead ends, and move faster—if we match their speed, cost discipline, and long-term focus. The blueprint is sitting right there: prioritise the mid-stream, bolt capacity onto existing plants, lock offtakes, build allied corridors, and treat minerals as sovereign capability instead of just commodities. China’s 2025 export controls ended the deniability. The game is now open. We know the plan. We have the assets. What we lacked was the will to execute like we mean it. Sovereignty at scale, on commercial terms. That’s how we win. Full piece: Chinas Vision of Victory and the West’s Industrial Revival #criticalmineralshub #mineralimperative https://lnkd.in/dEticnaC

Relatively small amounts of critical minerals underpin trillions of dollars in economic value globally. New IEA analysis highlights growing risks, including export controls, although countries are also taking steps to make supply chains more secure 👉 https://iea.li/4aTpQ33 The geographic concentration of critical mineral supply chains continues to grow, particularly for refining. Rare earths are the exception. The top supplier's share fell from 90% in 2023 to 85% in 2025, showing progress is possible with strong policies. Read more in the International Energy Agency (IEA)’s Global Critical Minerals Outlook 2026 👉 https://iea.li/4bNpwDh While critical mineral projects are being announced & developed across the globe, we see a structural imbalance in diversification efforts. Investment outside the dominant supplier remains concentrated in mining, while efforts to expand refining & downstream capacity lag behind. In a complex geopolitical environment, critical minerals have moved to the forefront of countries’ energy, economic & national security agendas. This is making a difference: public finance commitments more than quadrupled between 2023 and 2025, reaching $65 billion. New IEA analysis also sees a major opportunity to diversify supplies of strategic minor minerals. The investment needed is much smaller than the potential risks of disruption and can be seen as economic insurance. Since #CriticalMinerals account for a small share of final product prices, the cost of diversification could have a limited impact on consumers. For example, critical minerals account for around a quarter of battery cell costs but only about 3% of the price of an average EV. Diversified supply is not only a matter of investment: it also means tackling gaps in technology, equipment & workforce skills. Our new Global Critical Minerals Outlook 2026 includes guidance for policymakers on this & more. Read it in full on our site 👉 https://iea.li/4bNpwDh

Jaguar Land Rover. Factories stalled. Supply chains bleeding. Hundreds of millions in losses. All because of one thing: a cyber attack. When “everything is connected,” one breach doesn’t just take down a server. It takes down plants. Workers. Suppliers. Customers. Entire ecosystems. That’s the reality of today’s business world. A single compromise can bring global operations to a standstill. And here’s the uncomfortable truth: Most businesses still treat cybersecurity like a checkbox. Something you outsource. Something you worry about after growth. But attacks like this remind us: security is not an IT problem. It’s a business survival problem. So what can every business (big or small) learn from this? → Build resilience into every layer. Don’t let “everything connected” mean “everything vulnerable.” → Monitor the dark web. Your stolen data often shows up there before you even know you’re breached. → Know your supply chain risk. Your weakest vendor can be the hacker’s easiest way in. → Test your incident response before you need it. Recovery speed decides the damage. → Treat cybersecurity as core to strategy, not an afterthought. Because downtime doesn’t just kill servers. It kills trust. Your customers won’t remember how fast you shipped features. They’ll remember how you protected their data when it mattered. Still think cybersecurity slows you down? Ask JLR’s factories what real downtime looks like. #CyberSecurity #DarkWebMonitoring #Ransomware #SupplyChainSecurity  #BusinessContinuity #DataProtection #CyberResilience #InfoSec #CISO #RiskManagement

The growing complexity of supply chain interdependencies is creating significant cybersecurity risks. In my latest article for the World Economic Forum’s Centre for Cybersecurity, I outline five key risk factors and what organisations must do to mitigate them: 1️⃣ Cyber Inequity – Large organisations are improving cyber resilience, but SMEs remain vulnerable. They must view cybersecurity as a business priority, while industry collaboration and policy support can help bridge the gap. 2️⃣ Limited Supply Chain Visibility – Expanding supply chains make it harder to assess supplier security. Without clear incentives, compliance gaps persist, increasing exposure to cyber threats. 3️⃣ Third-Party Software Vulnerabilities – AI and open-source adoption introduce new risks, yet only 37% of organisations assess AI tool security before deployment. A structured security framework is essential. 4️⃣ Dependence on Critical Providers – Over-reliance on a few key suppliers creates systemic points of failure. Resilient IT architectures and strong business continuity planning are critical. 5️⃣ Geopolitical Risks – Cyber threats are increasingly shaped by global tensions, disrupting supply chains and increasing attack sophistication. Organisations must integrate geopolitical risk assessments into their cybersecurity strategies. 𝗪𝗵𝗮𝘁’𝘀 𝗡𝗲𝘅𝘁? Organisations must prioritize visibility, support smaller partners, and invest in resilience. Strong business continuity planning, robust IT management, and proactive threat detection are non-negotiable. Cybersecurity is not just an IT issue—it’s a strategic imperative. Read the full article here: https://lnkd.in/g-yQ2QRa #CyberSecurity #SupplyChain #AI #RiskManagement

Third-Party Risk: The Hidden Cybersecurity Battlefield in Modern Supply Chains In our interconnected digital ecosystem, your security posture is only as strong as your weakest vendor. Modern enterprises rely on 100s of third-party vendors, creating an exponentially expanding attack surface. Supply chain attacks have become the preferred vector for sophisticated threat actors. Instead of targeting well-defended enterprises directly, attackers exploit vulnerabilities in trusted vendors to simultaneously breach hundreds of downstream organizations. Game-Changing Examples SolarWinds (2020): Compromised software updates affected 18,000+ customers including Fortune 500 companies and government agencies, demonstrating how a single vendor breach cascades across entire sectors. MOVEit (2023): A single vulnerability led to data breaches affecting over 600 organizations globally, showcasing the massive scale of modern supply chain impacts. Why Third-Party Risk Monitoring is Critical Continuous Visibility: Traditional annual assessments are insufficient. Organizations need real-time monitoring of vendor security posture, breach notifications, and compliance status changes. Risk Amplification: When attackers target managed service providers or software vendors, the impact multiplies across all their clients. One compromised vendor can expose thousands of organizations simultaneously. Regulatory Liability: With GDPR, CCPA, and emerging supply chain regulations, organizations face increasing liability for third-party security failures. Proactive monitoring demonstrates due diligence. Building Effective Defense Continuous Assessment: Implement real-time vendor risk scoring across your entire ecosystem Zero Trust Extension: Apply least-privilege access controls to all third-party connections Incident Response Integration: Ensure your IR plans account for vendor breaches with clear communication protocols Contractual Protection: Update vendor agreements with security requirements and liability provisions The Bottom Line Organizations can no longer treat vendor risk as procurement afterthought. The question isn't whether your supply chain will be targeted — it's whether you'll detect and respond effectively when it happens. The strongest security programs extend beyond organizational boundaries to create defensible ecosystems, not just defensible enterprises. #ThirdPartyRisk #TRPM #SupplyChainAttack #CyberSecurity

Most procurement teams measure supplier performance the same way: cost reduction targets. Did you hit 3% cost down? Find a cheaper alternative? Negotiate better terms? That's not strategic sourcing. That's squeezing margins until suppliers can't invest in capability. Procurement should ask if their supplier makes the product better. Do they bring engineering that improves performance, reduces weight, or simplifies assembly? Can they help compete when someone launches cheaper? The supplier's role isn't absorbing cost pressure. It's enabling product strategy. Great suppliers don’t just execute; they optimize. They provide rigorous Design for Manufacturing (DFM) feedback that strips out unnecessary costs before a single part is run. By constantly investing in state of the art machinery and processing capabilities, these partners deliver continuous efficiency gains that a stagnant, low cost bidder simply cannot match. I see customers leave suppliers who can't solve problems, only run parts. They need someone who suggests composites instead of metal, challenges specs that cause failures, or integrates features that eliminate assembly steps. That's what makes products competitive. Not 3% cost cuts. Most procurement organizations commoditize suppliers instead of partnering. They treat engineering capability as overhead, not strategic value. Then wonder why their supply base can't innovate. If your only metric is cost down, you're training suppliers to stop investing in engineering. You're selecting for cheapest bid, not best capability. At Atlas Fibre, we are routinely the best bidder for complex components, but we don’t get there by cutting corners or sacrificing quality. We win through total vertical integration and a relentless, non-negotiable investment in our people, technology, and equipment. We don't wait for the customer to demand a lower price; we build the infrastructure to make a lower price the natural byproduct of superior engineering. Strategic sourcing means finding suppliers who make your product harder to compete with. Your supplier either enables your brand or undermines it. #StrategicSourcing #SupplyChain #Procurement #Manufacturing

We often treat cyberattacks as isolated technical incidents. But in reality, a single ransomware event can trigger disruptions that span industries, economies, & even national security. This isn’t hypothetical. As Jess Burn explores in her recent Forrester piece (“Too Big To Fail, Cyber Edition”), we’re operating in a deeply interdependent environment where one breach can cascade across sectors and borders. The impact is no longer confined to a single company, it’s systemic. At Palo Alto Networks and through our work at Palo Alto Networks Unit 42, we’ve seen firsthand how the most resilient organizations are the ones preparing beyond their own walls. That means: ⭐ Testing crisis scenarios that include third parties, not just your internal team ⭐ Bringing suppliers to the table during tabletop exercises and resilience planning ⭐ Moving from static risk assessments to real-time monitoring ⭐ Micro segmenting your environment to reduce blast radius ⭐ And reinforcing vigilance against social engineering at every level This is a boardroom concern, a national imperative, and a shared responsibility. If you haven’t tested your response across your full ecosystem, now is the time to start.

Today's Axios npm supply chain attack is a masterclass in how modern threat actors operate. Attackers pre-staged the malicious payload 18 hours before execution, poisoned both release branches within 39 minutes, and deployed a cross-platform RAT that immediately began harvesting credentials, API keys, and crypto wallets before self-deleting its tracks. For CISOs and security insurance leaders, this is the threat model that keeps supply chain risk squarely on the board agenda. The question isn't whether your organisation uses open-source dependencies it's whether you have visibility into what they're doing at install time. Three immediate questions to ask your team today: → Do you pin dependency versions in production pipelines? → Do you have egress monitoring on CI/CD environments? → How quickly could you rotate every credential touched by a compromised build? The organisations that answer those questions confidently are the ones that turn an incident like this into a near-miss.

Food systems are national security infrastructure. We just don’t treat them that way. In response to Trump’s renewed push for higher defence spending, Spain’s Prime Minister Pedro Sánchez has argued that defence must also include climate adaptation, energy transition and wider system resilience. Whether or not you agree, the fact this is now part of the global defence debate is telling. ➡️ Food systems are already under pressure—from climate disruption, water scarcity and energy volatility. ➡️ Security isn’t just about military capability—it’s about the systems that keep countries functioning. ➡️ As global instability grows, food and climate resilience are becoming core to national strategy. For food businesses, this shift matters. Resilience is no longer just operational—it’s a measure of leadership and long-term value. Those investing in climate-proof supply chains, adaptive infrastructure and system-level impact won’t just manage risk—they’ll define the future of food security. The question isn’t whether food is part of national security—it’s how quickly we start acting like it is. What would it take to embed this thinking at the centre of strategy and the global conversation?

In 1987 Deng Xiaoping said: "The Middle East has oil. China has rare earths." For 40 years, the West largely ignored that warning. Now Washington is finally paying attention. China controls the supply of a staggering share of the world's critical minerals—the 30 to 60 metals that power everything from iPhones and data centres to F-35 jets, electric motors and surgical lasers. Last April Beijing restricted exports of seven rare earths. In October it added another five to the list. Supply chains for missiles, drones and radars threatened to snap. Carmakers across Europe and Asia were forced to idle plants. The Trump administration—stung—quickly scaled back tariffs on China to secure a truce. China didn't stumble into this position. It engineered it. So what is America doing about it? Everything, all at once—and at speed. → The Pentagon has committed $2.8bn to mining and refining projects since October alone → The Export-Import Bank has issued $15bn in letters of intent for mineral ventures worldwide → 21 bilateral mineral pacts signed, with countries ranging from Argentina to Uzbekistan → A $12bn national stockpile—"Project Vault"—is being built → Price floors are being proposed to shield Western producers from Chinese dumping As one mining executive puts it: "They are working their way through the periodic table." The ambition is vast. So are the gaps. The US approach is aggressive, imaginative—and risky. Billions are being spread across 60 minerals with a scattershot strategy. The plan also assumes that Western subsidies can outlast Chinese patience—a bet that hasn't paid off well historically. Price floors are tricky to set and distort markets. And the biggest vulnerability—China's near-total dominance in refining—is barely being addressed. Even ore dug up in Brazil or Congo still has to go through China to become usable. Markets are sceptical. Metals prices have barely moved in response to Washington's announcements. Chinese mining firms are continuing to acquire assets abroad, unfazed. America is finally reckoning with a vulnerability it had decades to prevent. The question isn't whether the race has started. It's whether the West can overcome a 40-year head start. Our cover story this week, which I wrote together with my excellent colleagues Anjani Trivedi, John McDermott, Cerian Richmond Jones and Vijay Vaitheeswaran https://lnkd.in/e5R2hrqA