By Matan Or-El, CEO & Co-Founder of Panorays

When I first read about the ransomware attack on Collins Aerospace and its Muse software, what struck me wasn’t just the technical details. It was the image of stranded passengers in European airports, airlines scrambling to find workarounds, and entire operations disrupted. All because of a single vendor’s compromise.

This is the reality of our interconnected world: the weakest link in your supply chain can become your biggest vulnerability. Collins Aerospace isn’t a small supplier. They’re a critical part of the aviation ecosystem, and yet, when they were hit, the ripple effects were immediate and far-reaching.

The attack itself was significant. According to ENISA, ransomware took down Collins’ Muse platform, a system that supports critical airline functions like check-in and boarding coordination. That disruption rippled through major European airports, from Heathrow to Berlin to Brussels, forcing emergency workarounds and slowing down passenger flows. Reports suggest more than a thousand computers may have been affected, many of which couldn’t even be fixed remotely. For an industry where timing is everything, those hours of downtime meant chaos.

Why Continuous Vendor Risk Monitoring Is Critical in Today’s Threat Landscape

For years, many organizations treated vendor risk as a box to check: send out a questionnaire, collect the responses, file them away. But risk doesn’t stand still. Vendors update their applications, change configurations, expand into new cloud services, and expose new assets, and attackers are watching all of it in real time. A once-a-year snapshot won’t protect you when the threat landscape changes by the hour.

The Collins incident is not just another “breach in the headlines.” It’s a reminder that resilience isn’t about defending only your own perimeter. It’s about understanding, continuously, the health of your extended digital ecosystem. Because when one vendor falls, we all feel the impact.

Why One-Time Vendor Vetting Falls Short: The Case for Continuous Risk Management

Too often, I see organizations assume that because they’ve vetted a supplier once, the risk has been managed. That assumption is dangerous. Risk is not static. Cybercriminals thrive on blind spots, and vendor ecosystems are full of them.What this incident shows us is that continuous monitoring, prioritization, and collaboration with vendors isn’t a luxury. It’s essential.

Key Questions Every Leader Should Ask to Strengthen Vendor Cybersecurity Resilience

If you’re leading an organization today, here are the questions I’d be asking my team tomorrow:

  • Do we have visibility into our vendors’ security posture right now – not six months ago?
  • When a vendor exposure is found, do we have an incident response playbook to contain it quickly?
  • Are we treating every risk finding with the same urgency, or are we prioritizing based on impact?

And maybe most importantly: are we building resilience not just inside our four walls, but across the network of partners we depend on?

From Me to We: Building Shared Cybersecurity Resilience Against Supply Chain Attacks

Supply chain attacks aren’t going away. In fact, they’re accelerating. What will separate those who weather the storm from those who are caught unprepared is how seriously we take the responsibility to see beyond our own perimeter.

At Panorays, this belief – that resilience is shared – is what drives us. The Collins Aerospace attack is a wake-up call, but it can also be a turning point if we choose to learn from it.

Because in today’s interconnected world, cybersecurity is no longer about me. It’s about we. Book a demo with Panorays to start strengthening your supply chain resilience today.