T1591.002, Reconnaissance

Business Relationships

Mapping the invisible web of vendor partnerships, supply chains, and trusted third parties that attackers exploit as backdoors into fortified networks...

// Business Relationship Trust Topology, Real-Time Visualization

TRUST: STRONG

TRUST: MEDIUM

TRUST: WEAK

🏢

TARGET
ORG

☁️

SaaS Platform

SaaS Providers

🗃

Cloud Host

Cloud Hosts

🚚

Logistics Partner

Supply Chain

💳

Banking Partner

Financial Partners

💻 VULNERABLE

IT Managed Services

IT Vendors

▶ Compromise Cascade: One Weak Partner → Target Breached

IT Vendor Compromised Credentials Stolen API Keys Exposed Lateral Movement TARGET BREACHED

☠ Compromised IT Vendor (Managed Services Provider)

🏢 Target Corporation

🏥 Subsidiary A

🏥 Subsidiary B

💼 Client Company C

🏥 Partner Org D

PARTNERS ENUMERATED

WEAK LINK IDENTIFIED

CASCADE TRIGGERED

// Section 02

Why Business Relationships Matter

97%

Organizations impacted by
supply chain breaches

30%

Breaches involving third parties
in 2025 (doubled)

5.28

Average downstream victims
per breach (record high)

$4.44M

Average breach cost
supply chain cases higher

Business relationships create implicit trust pathways that adversaries systematically exploit to bypass an organization's direct security controls. When a company builds partnerships with vendors, suppliers, cloud providers, and service organizations, they inevitably extend digital access, API credentials, network connections, shared data repositories, and integrated systems, to external parties whose security posture they cannot fully control. Adversaries recognize that attacking a well-defended target directly is resource-intensive and risky, but compromising a weaker partner in the target's business ecosystem provides a trusted pathway into the primary victim's environment. This asymmetric advantage makes Business Relationships (T1591.002) one of the most impactful reconnaissance sub-techniques in the MITRE ATT&CK framework.

The statistics paint a grim picture of the current threat landscape. According to Infosecurity Magazine, 97% of organizations have been negatively impacted by a supply chain breach, underscoring that virtually no enterprise is immune to this attack vector. The 2025 supply chain attack statistics compiled by DeepStrike reveal that third-party breaches have doubled to 30% of all incidents, with data from Verizon's DBIR and Recorded Future confirming this accelerating trend. Perhaps most alarmingly, research from IndustrialCyber and Black Kite shows the average breach now produces 5.28 downstream victims, the highest number ever recorded, demonstrating the cascading devastation that supply chain compromises unleash across interconnected business ecosystems.

The financial impact compounds the operational damage. IBM's Cost of a Data Breach report, cited by DeepStrike, places the average breach cost at $4.44 million, with supply chain-specific cases costing even more due to regulatory penalties across multiple jurisdictions, multi-party litigation, and the reputational damage of failing to protect not just your own data but your partners' data as well. Research from Huntress and the DBIR found that 15% of breaches involved a third party, while the World Economic Forum reports that 72% of cyber risks have risen in the past year. These figures confirm that business relationship reconnaissance is not a theoretical concern, it is an active, growing, and devastatingly effective attack methodology that every security team must address through comprehensive third-party risk management.

MITRE ATT&CK T1591.002 CISA Best Practices Fortinet 2025 Report DeepStrike 2025 Stats Infosecurity Magazine

// Section 03

Key Terms & Concepts

Simple Definition

Business Relationships (T1591.002) is a sub-technique under MITRE ATT&CK's Reconnaissance tactic where adversaries identify and map the partnerships, vendor relationships, supply chain connections, and business affiliations of a target organization. This includes cloud service providers, SaaS platforms, IT consultants, financial institutions, logistics partners, and any third party with digital access to the target's environment. Adversaries gather this intelligence through public records, SEC filings, press releases, job postings that mention specific tools or platforms, LinkedIn connections, procurement databases, and DNS records that reveal hosted services. The goal is to build a comprehensive map of the target's business ecosystem and identify the weakest link in the trust chain, the partner with the least robust security posture, to launch a supply chain attack that bypasses the target's direct security controls entirely. This technique is particularly dangerous because organizations frequently lack visibility into their partners' security practices and may have hundreds or thousands of digital relationships, each representing a potential attack vector.

Everyday Analogy

Think of business relationships like a neighborhood watch program where everyone has given spare keys to various service providers. Your house has excellent security, reinforced doors, alarm systems, security cameras, and motion-sensor lights. But you've given spare keys to your plumber, your dog walker, your house cleaner, your gardener, and your neighbor. Each of them has also given copies of their keys to their own assistants and subcontractors. If any single person in this chain loses their key, gets robbed, or turns malicious, your house becomes vulnerable too, not because your security failed, but because you extended implicit trust to someone whose security did fail. Business relationships work identically in the digital world. Your organization shares API credentials, network access, and data integrations with dozens of partners, and each of those partners has their own partners and subcontractors. Compromising any single entity in this extended trust chain can provide an adversary with a pathway into your network that completely circumvents your sophisticated defenses.

Supply Chain Attack Risk Assessment

Organizations typically have far more business relationships than they actively manage from a security perspective. The average enterprise has 45+ digital partner connections, but fewer than 20% undergo regular security assessments. This asymmetry creates enormous attack surface that adversaries are increasingly targeting.

SUPPLY CHAIN EXPOSURE INDEX

LOW MODERATE HIGH CRITICAL

Adversary Research

→

Partner Identified

→

Vendor Compromised

→

Trust Exploited

→

Target Breached

// Section 04

Real-World Scenario

👤 Priya Sharma, CISO, HealthGrid Systems

HealthGrid Systems is a healthcare technology provider serving 200+ hospitals across the United States, managing electronic health records, medical device integrations, and patient data analytics for millions of individuals.

⚠ Before: The Supply Chain Blind Spot

HealthGrid had digital connections to 45 partner organizations, EHR vendors, medical device suppliers, insurance billing processors, and cloud analytics providers, with no centralized vendor risk management program. Each department independently onboarded vendors with minimal security vetting, and no one maintained a comprehensive inventory of third-party access points. When attackers compromised a small medical device manufacturer with weak security, an organization HealthGrid's CISO didn't even know was connected to their network, the adversaries traversed through an unmonitored API integration into HealthGrid's environment. Within days, they accessed patient records of 2.3 million individuals across 60+ hospitals. The breach triggered HIPAA penalties of $8.5 million, class-action lawsuits totaling $120 million, and caused HealthGrid to lose 30% of their hospital clients within a year. The medical device manufacturer had a single firewall and no intrusion detection system, yet they held API keys that provided access to HealthGrid's most sensitive patient data systems. The attackers identified this weak link through public procurement records and LinkedIn connections, demonstrating exactly how T1591.002 reconnaissance enables devastating supply chain compromises.

✓ After: Comprehensive TPRM Program

Priya implemented a comprehensive third-party risk management (TPRM) program that transformed HealthGrid's security posture. She established vendor security scorecards requiring every partner to demonstrate SOC 2 Type II compliance, implemented zero-trust API integrations so that each partner access request was individually authenticated and authorized with least-privilege permissions, deployed continuous monitoring of partner security posture using automated risk rating platforms that alert when a vendor's security score drops below acceptable thresholds, and instituted contractual security requirements with every vendor including breach notification timelines, right-to-audit clauses, and mandatory incident response capabilities. Most critically, she created supply chain compromise playbooks specifically for scenarios where a partner is breached, enabling HealthGrid to rapidly revoke access, rotate credentials, and isolate potentially compromised systems. The program also included quarterly business relationship audits that mapped all digital dependencies and identified shadow IT connections that departments had established without security team knowledge, reducing their attack surface by 40% in the first year.

// Section 05

How Adversaries Execute T1591.002

The 7-Step Business Relationship Reconnaissance Playbook

Understanding the adversary's methodology is essential for building effective defenses. Here is the typical seven-step process attackers follow when leveraging Business Relationships as a reconnaissance sub-technique to identify and exploit supply chain attack vectors.

Identify Target Organization

Select the primary target based on strategic value, financial data sensitivity, or geopolitical significance. Adversaries research the target's industry, size, and technology stack.

Map Business Relationships

Systematically enumerate all partners, vendors, and affiliates using public sources: SEC filings, press releases, job postings, LinkedIn connections, procurement databases, and “powered by” or “partnered with” badges on websites.

Identify Digital Connections

Determine which partners have digital access to the target: API integrations, shared cloud environments, VPN connections, SSO federation, data exchange portals, and DNS records revealing hosted services.

Assess Partner Security Posture

Evaluate each partner's security maturity through public breach history, security rating services, certificate transparency logs, exposed credential databases, and job postings that reveal outdated technology stacks.

Select Weakest Link

Rank partners by vulnerability and access depth. The ideal target has both weak security controls and deep, privileged access to the primary target's environment, typically IT managed service providers or small specialized vendors.

Compromise Selected Partner

Launch targeted attacks against the selected partner using phishing, credential stuffing, exploiting known vulnerabilities, or purchasing access from initial access brokers. The partner's weaker defenses make this significantly easier than attacking the primary target.

Pivot to Primary Target

Use the compromised partner's legitimate access to pivot into the target organization. This may involve abusing API keys, exploiting trusted network connections, impersonating the partner in communications, or deploying malicious software through legitimate update channels.

// Section 06

Common Mistakes & Best Practices

❌ Common Mistakes

Onboarding vendors without security assessments or due diligence, granting them access based solely on business need without verifying their security posture meets minimum standards
Failing to maintain a comprehensive inventory of third-party digital connections, leaving shadow IT relationships undiscovered and unmonitored by security teams
Granting partners excessive privileges and broad access scopes rather than implementing least-privilege access with granular permissions tied to specific business functions
Not including security requirements in vendor contracts, such as breach notification timelines, right-to-audit clauses, and mandatory security certifications
Ignoring fourth-party risk, the vendors your vendors use, which extends the attack surface far beyond your direct business relationships
Treating vendor risk assessment as a one-time checkbox exercise during onboarding rather than implementing continuous monitoring throughout the relationship lifecycle

✓ Best Practices

Implement a formal Third-Party Risk Management (TPRM) program with standardized security scorecards, risk tiers, and mandatory assessments before granting any vendor digital access
Maintain a live inventory of all business relationships and their digital access points, conducting quarterly audits to identify shadow IT and unauthorized partner connections
Apply zero-trust architecture principles to all partner integrations: every API call, every data exchange, and every network connection requires continuous authentication and authorization
Deploy automated continuous monitoring tools that track partner security posture changes in real-time, generating alerts when vendor risk scores degrade below acceptable thresholds
Include comprehensive security requirements in all vendor contracts: SOC 2 Type II compliance, encryption standards, breach notification within 24 hours, and annual penetration testing
Develop and regularly test supply chain compromise incident response playbooks that specifically address scenarios where a partner is breached and your access may be compromised

// Section 07

Red Team vs. Blue Team Perspectives

RED TEAM

Attacker Mindset

The red team views business relationships as the path of least resistance into a target organization. Rather than investing resources in attacking well-defended perimeters, red team operators systematically identify and catalog every partner, vendor, and affiliate connected to the target. They prioritize partners with the broadest, deepest access and the weakest security controls, typically small IT service providers, specialized SaaS vendors, or regional logistics partners who lack mature security programs.

Red team methodology begins with extensive open-source intelligence gathering: analyzing SEC 10-K filings for disclosed business relationships, scanning LinkedIn for vendor-employee connections, examining job postings that reveal specific technologies and platforms in use, and reviewing public procurement records. Once a weak partner is identified, the team crafts targeted phishing campaigns against partner employees, exploits known vulnerabilities in partner-facing web applications, or purchases initial access through dark web marketplaces. The compromised partner's legitimate credentials and API keys then serve as trusted entry points into the primary target, completely bypassing its security infrastructure.

OSINT: LinkedIn OSINT: SEC Filings Tool: SecurityScorecard Tool: Shodan TTP: Phishing

BLUE TEAM

Defender Mindset

The blue team recognizes that their organization's security is only as strong as the weakest link in their business ecosystem. Defenders understand that adversaries will inevitably probe partner relationships seeking exploitable vulnerabilities, so they must maintain comprehensive visibility into all third-party connections and their associated risk levels. This requires moving beyond traditional perimeter-focused security to embrace a holistic approach that accounts for the entire supply chain.

Blue team defenders implement multi-layered protections: continuous monitoring of partner security postures using automated risk rating platforms, network segmentation that isolates partner-accessible systems from critical infrastructure, zero-trust access controls that require ongoing verification for every partner interaction, and behavioral analytics that can detect when a partner's access patterns deviate from established baselines. They also establish rapid-response protocols for supply chain compromise scenarios, including pre-authorized credential revocation procedures, network isolation plans, and communication templates for notifying partners and regulators when a supply chain incident is detected.

Tool: BitSight Tool: CyberGRX Framework: NIST SP 800-161 Control: Zero Trust Control: NAC

// Section 08

Threat Hunter's Playbook

Hunting Hypothesis

Adversaries performing Business Relationships reconnaissance (T1591.002) will leave detectable traces across multiple data sources. Hunters should formulate hypotheses around anomalous access patterns from partner accounts, unexpected vendor network connections, and indicators that external entities are actively mapping the organization's business ecosystem. The key insight is that business relationship reconnaissance is not a single event but a sustained campaign that unfolds over weeks or months, creating multiple opportunities for detection.

Hunting Queries & Indicators

Query 1: Unusual Partner Account Activity

index=auth source="partner_*" (action="login" OR action="api_call") | stats count by user, partner_id, src_ip | where count > baseline_count * 2 | sort -count

Monitor for partner accounts exhibiting login frequencies or API call volumes significantly above their established baseline, which may indicate credential compromise or unauthorized access through a compromised partner system.

Query 2: New Vendor Network Connections

index=firewall action="allow" dest_zone="partner_dmz" | stats dc(dest_ip) as unique_targets by src_ip | where unique_targets > 5 | sort -unique_targets

Detect partner network connections targeting multiple internal systems, which deviates from expected point-to-point access patterns and may signal lateral movement from a compromised vendor environment into your infrastructure.

Query 3: OSINT Exposure Indicators

Hunt for signs that adversaries are actively researching your business relationships: unexpected spikes in traffic to vendor listing pages on your website, LinkedIn profile views from suspicious accounts targeting employees who manage vendor relationships, and references to your organization on dark web forums discussing supply chain attack opportunities. Monitor certificate transparency logs for newly issued certificates that impersonate your partners, and track public procurement databases for information about your vendor relationships that could guide adversary targeting decisions.

Source: EDR Logs Source: Firewall Source: SIEM Source: CT Logs Source: OSINT

Secure Your Business Ecosystem

Business relationship compromise is not a hypothetical threat, it is the fastest-growing attack vector in cybersecurity. Every vendor connection, every API integration, and every partner data exchange represents a potential pathway into your organization. The question is not whether adversaries will probe your supply chain, but whether you will be ready when they do.

Start by inventorying every third-party digital connection your organization maintains. Assess each partner's security posture. Implement zero-trust access controls. Build supply chain incident response playbooks. And remember: your security is only as strong as the weakest link in your business ecosystem. Take action today to ensure that link is not your organization's downfall.

← T1591 Parent: Gather Victim Org Info T1591.001: Business/Government Entity T1591.003: Organizational Structure T1591.004: Industry Relationships

Network Security Appliances

MITIGATIONS

Pre-compromise M1056

DETECTION STRATEGY

Detection of Network Security Appliances DET0889

DONATE · SUPPORT

We keep threat intelligence free. No paywalls, no ads. Your donation directly funds server infrastructure, research, and tools. Every contribution - no matter the size - makes this platform sustainable.

100% of your support goes to the platform. No corporate sponsors, just the community.

ROOT::DONATE

Cyber Pulse Academy
April 2, 2026
No Comments