AI Supply Chain Compromise Assessment Playbook

A Fortune 500 company's SOC received a notification that a third-party software vendor used by 340 of its employees was compromised in a supply chain attack. The vendor's update pushed 6 weeks ago. The SOC needs to assess internal impact before the board briefing in 4 hours.

When to use this playbook

• Use this playbook when the decision looks like the situation above: A Fortune 500 company's SOC received a notification that a third-party software vendor used by 340 of its employees was compromised in a supply chain attack.
• It is a fit when you have source files in hand and need a structured, reviewable analysis — not a generic chat answer about "Supply Chain Compromise Assessment".
• Do not use it as a substitute for licensed, legal, clinical, or authorized official judgment in the domain.

What you'll need

• Vendor software install inventory (all endpoints with version and install date)
• SIEM logs from all endpoints with the vendor software (6 weeks)
• Network flow data for the vendor's update server IP
• EDR process tree for the vendor application on all affected hosts
• Published IOCs from the vendor's breach notification

Attachments: Documents (Documents)

You are a SOC lead assessing internal impact of a supply chain compromise. I am attaching:

Work only from the attached source files. If a conclusion is not supported, say so.

Produce:
1. Identify all internal endpoints with the compromised software version and whether the malicious update was successfully installed.
2. Cross-reference installed endpoints against the published IOCs: C2 domains, IP addresses, file hashes, and registry keys.
3. Identify any lateral movement from compromised endpoints: new admin account creation, credential harvesting tools, or unusual authentication events.
4. Assess the crown jewel risk: which compromised endpoints have access to sensitive systems (finance, HR, IP, customer data)?
5. Draft the board briefing summary: what we know, what we don't know, what we've contained, and what the 24-hour action plan is.

Call out where independent models are likely to disagree, and list follow-up documents a reviewer should request.

What to expect

• Compromised endpoint inventory
• IOC match results by endpoint
• Lateral movement indicators
• Crown jewel exposure assessment
• Board briefing draft with known/unknown/contained framework

Review before you act

• Validate this output against source files before relying on it: Identify all internal endpoints with the compromised software version and whether the malicious update was successfully installed.
• Validate this output against source files before relying on it: Cross-reference installed endpoints against the published IOCs: C2 domains, IP addresses, file hashes, and registry keys.
• Validate this output against source files before relying on it: Identify any lateral movement from compromised endpoints: new admin account creation, credential harvesting tools, or unusual authentication events.
• Validate this output against source files before relying on it: Assess the crown jewel risk: which compromised endpoints have access to sensitive systems (finance, HR, IP, customer data)?.
• Confirm every cited figure, date, counterparty, or requirement against the attached originals — models compress and can drop a qualifier.
• Treat disagreement between models as a review item, especially on classification, materiality, and recommended next action.
• Do not authorize an operational, clinical, legal, credit, or enforcement action solely because the models agree.