On March 11, Stryker — a $20B+ medical device company supplying hospitals worldwide — got hit by what's being reported as an Iran-linked cyberattack. Order processing went down. Manufacturing disrupted. Shipping frozen. The NHS and hospitals across multiple countries found themselves scrambling to source critical surgical instruments and implants from alternate channels that, frankly, don't exist at scale.
Let that sink in. Not a port closure. Not a container ship stuck in a canal. Not a tariff war. A password. A vulnerability in a digital system. That's what took down a global medical supply chain.
After that, I led large-scale supply chain transformations And I'm telling you: what happened to Stryker is not an anomaly. It's a preview.
This Is Asymmetric Warfare — And Your ERP Is the Target
If you've been paying attention to the geopolitical landscape, the Stryker attack shouldn't surprise you. Cyber operations are now directly correlated with military and political conflict. Nation-state actors have learned that you don't need physical force to cripple an economy. You just need to get inside their supply chain systems.
This is classic asymmetric warfare. You find the seam. The gap. The thing they forgot to protect because they were too busy reinforcing the obvious.
For global supply chains, that seam isn't the port of Long Beach. It isn't a shipping lane in the South China Sea. It's the ERP system running your procurement operations. It's the vendor portal with credentials that haven't been rotated since 2019. It's the legacy system your IT team keeps meaning to patch but never does because "it still works."
Legacy Systems Are the Biggest Vulnerability — Full Stop
SupplyChainBrain's 2026 outlook put it plainly: legacy systems and disconnected tools represent the single greatest vulnerability in modern supply chains. Not weather. Not geopolitics directly. Not labor shortages. The software and systems that procurement and operations leaders rely on every single day.
Think about what sits inside your ERP: supplier data, pricing agreements, demand forecasts, production schedules, shipping logistics, payment information. It's the central nervous system of your supply chain. And in most organizations, it's protected by the same security posture that was "good enough" five years ago.
Here's the uncomfortable truth I've seen firsthand across multiple enterprise engagements: procurement teams operate in a patchwork of systems. The ERP talks to a sourcing tool that talks to a supplier portal that talks to a logistics platform — often through integrations built by people who no longer work at the company, documented in files nobody can find, secured by protocols nobody has audited.
Every one of those connections is a door. And most of them are unlocked.
This Isn't IT's Problem. It's Yours.
I've sat in too many executive meetings where cyber risk gets punted to the CISO and the IT department. "That's their lane." No, it isn't. Not anymore.
When a cyberattack shuts down your ability to process purchase orders, that's a procurement problem. When manufacturing goes offline because the production scheduling system is compromised, that's an operations problem. When your customers — hospitals, in Stryker's case — can't get the products they need to perform surgery, that's a business survival problem.
Procurement leaders need to own cyber risk the same way they own supplier risk, commodity risk, and logistics risk. It belongs in your risk register. It belongs in your quarterly business reviews. It belongs in your conversations with the C-suite.
If you're a CPO or VP of Supply Chain and you can't answer these questions right now, you have work to do:
- When was the last cyber risk assessment of your supply chain systems? Not your corporate network — your supply chain systems specifically. Your ERP, your supplier portals, your EDI connections, your logistics platforms.
- Have you audited your critical vendors' security posture? If a Tier 1 supplier gets breached and they're connected to your systems, that's your problem. Do you know what security standards they maintain? Do you have contractual requirements around it?
- Do you have an incident response plan that includes supply chain disruption from cyber events? Not a generic business continuity plan — a specific playbook for when your procurement systems go dark. Who makes buying decisions? How do you communicate with suppliers? How do you fulfill orders manually if you have to?
- Is your digital infrastructure diversified? Single points of failure in physical supply chains get attention. Single points of failure in digital supply chains get ignored. If your entire operation runs through one ERP instance with no failover, you're one breach away from being the next headline.
What Smart Leaders Are Doing Now
The procurement leaders who are ahead of this aren't waiting for their own Stryker moment. They're taking action:
Conducting cyber-specific supply chain risk assessments. Not generic IT audits — targeted assessments of the systems that run procurement, manufacturing, and logistics. Mapping the connections between systems. Identifying where legacy technology creates exposure.
Building security requirements into vendor management. Adding cybersecurity standards to supplier scorecards and contract terms. Requiring evidence of SOC 2 compliance, penetration testing, and incident response capabilities from critical suppliers.
Developing supply chain-specific incident response plans. War-gaming scenarios where key systems go offline. Establishing manual workarounds. Pre-positioning relationships with backup suppliers who can activate quickly.
Investing in digital infrastructure resilience. Evaluating cloud-based failover options. Segmenting networks so a breach in one system doesn't cascade across the entire supply chain. Modernizing legacy integrations that create hidden vulnerabilities.
Making cyber risk a standing agenda item in procurement leadership meetings. Not quarterly. Not annually. Continuously.
The Bottom Line
Twenty years ago, supply chain risk meant a hurricane hitting a port or a supplier going bankrupt. Ten years ago, it expanded to include trade wars and pandemics. Today, it includes a state-sponsored hacker halfway around the world shutting down your ability to do business with a few lines of code.
The Stryker attack is a wake-up call. But wake-up calls only work if you actually get out of bed.
Your supply chain's biggest vulnerability isn't a port. It isn't a ship. It isn't a border. It's the digital infrastructure you've been taking for granted — and the assumption that cybersecurity is someone else's job.
It's not. It's yours.