Why nearshoring won't solve your supply chain cyber risks

For years, cyber-security teams have warned that organisations don’t really know their supply chains.Not the suppliers they sign contracts with. The suppliers behind those suppliers.

 

That blind spot has become increasingly important as businesses rethink where they manufacture, source and distribute goods. Driven by geopolitical tensions, trade disputes and growing uncertainty around global commerce, many organisations are moving towards nearshoring strategies, bringing operations and suppliers closer to home.

 

According to a recent Thomson Reuters report, supply chain disruption has become one of the defining business challenges of 2026. Companies are being forced to navigate a combination of tariffs, regulatory complexity and shifting trade relationships that are making traditional global supply chains harder to manage.

 

The response has been a growing interest in regionalisation. Businesses that once depended heavily on suppliers thousands of miles away are increasingly looking for partners closer to their key markets. As noted in a recent analysis by Polaris Market Research, nearshoring is becoming a central part of broader resilience strategies across manufacturing and logistics sectors.

 

A smaller, more regional supplier network should be easier to understand, easier to assess and easier to govern. Working with suppliers that operate under similar regulatory frameworks can simplify compliance requirements and improve communication when incidents occur.

 

The reality, however, is more complicated. Moving suppliers from one region to another does not eliminate third-party risk. It simply changes its shape.

 

Many organisations have spent years assessing the security posture of established suppliers. Nearshoring often means onboarding entirely new partners, many of whom have not been subjected to the same level of scrutiny. In the rush to improve operational resilience, there is a danger that cyber-security due diligence becomes a secondary consideration.

 

This matters because supply chain attacks remain one of the most effective routes into large organisations. Attackers understand that compromising a trusted supplier can provide access to multiple downstream targets at once. Whether those suppliers are located on another continent or in a neighbouring country makes little difference if security controls are weak.

 

For decades, supply chains were designed around efficiency. Today they are increasingly being designed around resilience. Organisations are accepting that disruption is inevitable and are focusing instead on how quickly they can identify problems, adapt and recover.

 

Cyber-security has undergone a similar evolution. The conversation has moved beyond prevention towards resilience, visibility and recovery. Supply chain management is now following the same path.

 

That means cyber-security leaders need to be involved in nearshoring decisions from the beginning rather than after contracts have been signed. Questions about supplier visibility, continuous monitoring and third-party risk management should be treated as business issues, not purely technical ones.

 

Nearshoring may reduce some operational risks associated with an increasingly fragmented global economy. What it cannot do is remove the need to understand who your suppliers are, how secure they are and what happens if they are compromised.

 

In cyber-security, visibility has always been the foundation of resilience. The same is becoming true of supply chains.