Supply chain attack
Compromising a trusted vendor, software update, or contractor to reach their downstream customers.
For small firms
Your vendors' security is effectively your security — this is why vendor questionnaires matter even for small, low-cost tools.