Breaking Down the Risks: IP/cyber attacks

The risk of cyber-attack and IP theft over digital domains is constant and high and not going away. Not much need to be expounding the pounding on this one, but we will and give you a few tips on reducing the risk.

Expounding the Pounding

Cyberattacks remain high. Incredibly high. In 2014, a high year for cyberattacks, a NetIQ (acquired by AttachmateWRQ) Cyberthreat Defense Report found that 71% of organizations were affected by a successful cyberattack in 2014 (while only 52% expected to fall victim again in 2015). ( Source )

In 2024, North American organizations experienced an average of 1,298 cyberattacks per week, according to Check Point Research, which represented a 55% year-over-year increase in attacks. These attacks affected over 70% of of small to medium-sized businesses, according to Embroker. In other words, despite the continued increase in security software, standards and protocols, cyberattacks haven’t decreased, and neither have their success rate.

Reducing the Risk

Procurement is going to have to finally embrace cybersecurity best practices in everything they do as well as work with IT to ensure that all of the applications they buy or license meet these best practices as well.

Note that when we say best practices, we don’t just mean ensuring the technology meets all the latest specs, but that the organization, and its personnel, also ensures that they they take information security, operational security, and physical security seriously as well. An organization that doesn’t protect its information outside of systems is insecure, and if this includes passwords, the systems have been compromised with one login attempt. An organization that doesn’t maintain proper physical security makes it easy for an experienced hacker (who understands social engineering) to walk in, access a system that is logged in, extract the access keys for the broader systems, and the organization’s systems are then completely accessible by a hacker. And of course, if the organization doesn’t maintain proper operational security, its employees will let hackers right in no questions asked and all of the systems will be compromised.

This will require proper training and monitoring until everyone understands the issues across the entire organization.

Breaking Down the Risks: Natural/Man-Made Disasters

Disasters are on the rise. Why? Well, as per our last installment on talent, we are going to be expounding the pounding and giving you tips on reducing the risk.

Expounding the Pounding

As climate change has intensified, the number of natural disasters has risen sharply. Between 1980 and 1999, we experienced roughly 4,200 disaster events. Between 2000 and 2019, we experienced roughly 7,300 for an increase of roughly 75%.

Many of these were quite significant. According to the NOAA National Centers for Environmental Information, between 1980 and 2024, the US alone sustained 403 weather and climate disasters where overall costs and damages exceeded $1 Billion dollars (when CPI was adjusted to 2024) (Source: NCEI). The total cost of these events for the US has exceeded $2.9 Trillion dollars and resulted in 16,941 deaths.

Moreover, while the overall average frequency of Billion dollar weather/climate disasters over the last 45 years is 9, the average over the last 5 years is 23! In other words, natural weather/climate disasters are coming harder and faster than ever before (and the pace is still increasing).

If we turn our attention to the United Nations Office for Disaster Risk Reduction and review their 2025 Global Assessment Report on Disaster Risk Reduction (GAR), they found that while the direct costs of disasters averaged $70 Billion to
$80 Billion a year between 1970 and 2000, between 2001 and 2020 the costs ballooned to between $180 and $200 Billion a year and that disaster costs now exceed $2.3 Trillion ANNUALLY. Let that sink in. The global cost of natural disasters is now so great that only seven (7) countries have a GDP that exceeds that cost. In other words, the cost of these disasters, of which we now experience almost 400 a year (as the Emergency Events Database recorded 393 natural hazard related disasters in 2024, see ReliefWeb) exceeds the GDP of Russia, Canada, and Italy!

You’re going to be impacted by a natural disaster in the very near future to some extent. In most first world countries where a survey has been done the results are consistent: Four (4) out of Five (5) corporations agree that natural and climate disasters hurt because they were impacted in the last 5 years. Moreover, with the rapid rise in disasters your chance of not being impacted by a natural or climate disaster in the next 5 years is trending down to 10%. In other words, your chance of being impacted is 90%. It’s beyond the point that you have any chance of being one of the lucky ones. As per a 2023 Forbes article based on an Allianz Global Corporate & Specialty (AGCS) report, natural catastrophes are the largest driver of corporate insurance losses in the US because luck can’t save you now!

And we haven’t even started to talk about man-made disasters due to bad design, bad construction, bad maintenance, or just bad negligence that can result in entire skyrises being lost, manufacturing districts going up in smoke, ports exploding, entire swaths of land becoming unavailable due to nuclear meltdowns, global pandemics due to bacterial and viral leaks from research labs, and so on.

Reducing the Risk

Insurance

Do not, we repeat, do not forego the insurance! You will need it. However, unless you can prove you are employing best practices across the board this could be expensive. So you also need to employ a number of other best practices to make the insurance companies happy. (Although their Ren & Stimpy days are over. No more happy, happy, joy, joy because gone are the days when they only take in and never pay out.)

Third Party Vetting

Think those third party risk management / third party compliance management (TPRM/TPCM) solutions are a nice-to-have that you can wait on? Think again. You need to vet every supplier, every carrier, and every partner involved in the delivery of your goods from the factory to the store (and every warehouse, port, and transfer point in between). You need to prove you did your best to ensure only legitimate actors were in your supply chain so that you have some recourse (with insurance) when the shipment gets damaged or disappears (and to make sure you can afford your insurance premiums).

Overall Risk Vetting in Source Selection

Before you select a supplier as your chosen source of supply, you need to understand the 360-degree risks which are not just the supplier risks of financial stability, compliance, quality, human rights, and so on, but the risks related to its geolocation(s). Are there tensions between the country you are operating in and the country the supplier is operating/producing in that could lead to sanctions? Is there unrest that could lead to border closings due to uprisings? Is the area prone to natural or climate disasters that have been increasing in frequency in recent years? Etc. If the overall risk is high, and there is another supplier of comparable (which could mean slightly higher) cost that is considerably less risky, then you should be choosing the alternate, slightly higher, cost supplier.

Shipment Tracking / T(I)MS

You need to be tracking all of your shipments, and, preferably, have a Transportation (Information) Management System (T(I)MS) that integrates with your carriers. At the very least, you need to know when a shipment reaches each stop and then sets out for the next stop in the chain and know where it should be at all time. If the cargo is very high value or the carrier is a common target of criminal organizations because of what they typically carry (and that includes items like cell phones, laptops, and gold bars), then you need to ensure that the shipment is tagged and the truck, container, etc. is sending real time cellular signals at all time, that the carrier is monitoring their systems 24/7/365, and if a shipment ever goes dark for more than a few minutes or too far off course, and the driver cannot be immediately reached, law enforcement is immediately engaged. Unless, of course, you can afford to have 40 Million disappear! (A 40 foot shipping container can hold 44,000 iPhones. High end i-Phones are all 1K (or more) a pop. Do the math.)

Breaking Down the Risks: Loss of critical talent/limited talent availability

In our first series inspired by the latest and greatest CPO Survey that was just published by Deloitte, with the help of Spend Matters, which was designed to highlight, among other things, the latest and greatest “observations, challenges, and trends” in Procurement (and which included many survey results across enterprise priorities, focus, barriers to success, strategies, technologies, risks and competency gaps) we narrowed in on the top barriers to success that were common across all of the surveys and studies done by the big consultancies over the last five years. We presented you with a brief history, defined the core problem, and presented you with one more necessary realizations you need to make if you wish to make progress against the barriers.

In this series we will be tackling the risks, where we will be expounding on the pounding you are taking as a result of the risk as well as giving you some tips to reduce the risks. However, like the last series, in this series we will not be diving deep into the process upgrades or technological underpinnings you will need to adequately address them for the reasons discussed in the last series. Our goal is to give you the understanding you need to understand why the risks never change (and what realizations you first need to make if you want any hope of progress against them.)

Expounding the Pounding

As per one of our barriers to success on the talent gap in our first series, there is a talent gap which grows every year. This makes the loss of critical talent a major risk for many corporations who may only have one or two senior specialists capable of doing a specific, sophisticated, task that is vital to the organization. Especially when all of their organizational peers are in the same boat and there is a lack of replacement talent in the market.

This is especially true in sectors like manufacturing. As a result of decades of outsourcing and offshoring, and a lack of focus in the American (manufacturing) economy for decades, the number of senior, experienced resources in factory design and shop floor management is at an all time low and about to rapidly decrease in the next five years with the average manufacturing shop owner in the US being at least 62 years old. Let that sink in. A study by Crain’s Grand Rapids in 2021 found the average age four years ago was 62 and 70% of manufacturing business owners were over 59. (And America wants to bring manufacturing back? We applaud the vision, but we’re not sure how!)

Reducing the Risk

Unfortunately, in some industries, there is no way to reduce the risk. The talent is aging (rapidly) and the replacement pool is shrinking. (And with immigration being tightened in most countries, and forced deportations of all non-citizens in others, you can’t import the talent either.) The risk is only going to increase no matter what you do.

Therefore, you need to take steps to prepare for the inevitability and prepare your own critical talent (and ensure you have compensation programs and advancement opportunities in place that will make them want to stay once you embue them with the skills and knowledge they need).

In order to mitigate the risk to the extent possible, you need to do the following:

  1. install proper Knowledge Management Systems (KMS) and capture as much knowledge as you can from senior employees, document and institutionalize their processes, and capture their decisions and recommendations over time in the context of real world situations
  2. hire recent graduates or trainees with promise (and, preferably, not from business or procurement or operations backgrounds but from appropriate STEM (or Legal for contract negotiations) and have them mentored by a senior employee for at least a subset of the employee’s current role
  3. create, or (co-)sponsor, your own training programs (either internally or with partner educational programs) to ensure your next generation of talent is properly trained

That’s where you start. In our next post we will move onto the next major risk.

The Sourcing Innovation Source-to-Pay+ Cascading Mega Map! (2026 Edition)

 

(c) 2025-12-15

 

Still useless, but still slightly less useless than every other logo map that clogs your feed!

1. Every vendor offering verified as of 4 days ago!

2. Every vendor logo is clickable!

3. Every vendor is mapped to a meaningful category as of the last date of analyst investigation!

So what’s the point?

To again make it utterly clear you can’t select a vendor based on a random grouping of logos on a map, even if they are categorized!

Not even if the map categorizes the vendors by market size, industry, and/or geography. Those are just proxies for organizational spend, solution needs and cultural requirements. And not every mid-market manufacturing plant in the USA is the same.

The only way to select a good vendor is to follow a proper assisted process and engage an expert who understands what vendors are out there to identify the right vendors to invite to the RFP process once your true needs have been identified.

Especially considering the true number of vendors out there is many times more than what an average big analyst firm will tell you, especially when they restrict their recommendations to their paying clients in their maps, and multiples of what an average big consultancy will tell you, that only knows their partner solutions (that they need to maintain significant focus on to maintain their preferred partner status).

So let this be proof that there are a lot of logos and that, if you want logos, you got logos! 666 of them!

Source-to-Pay
Souce-to-Contract Procure-to-Pay Intake-to-Orchestrate
Sourcing + SXM + CLM Sourcing + Analytics SXM + Analytics e-Procurement Invoice-to-Pay / AP Expenses Payments (& P-Cards) Training
Sourcing + SXM Sourcing + CLM SXM + CLM Sourcing SXM CLM Analytics
Direct Supply Chain Cyber Monitoring ESG / Carbon Marketplaces Legal Marketing SaaS Intelligence

Source to Pay
corcentric coupa ebidtopay effigo
gep ivalua jaggaer onemarket onventis
raindrop sap simfoni synertrade zycus

Source to Contract
curtisfitch deepstream ensolva lgx
mercanis mercell merlin procol scanmarket
vendorpanel

Sourcing + SXM + CLM beneering buyingstation c1 cotiss
delta esm felix fullstep gainfront
intenda ionwave ispnext krinati lightsource
marketdojo marketplanet medius oalia oneadvanced
penny proactis proculy prokuria readytech
sourcingforce supplyon sustainment tradeinterchange vortal
workday zapro

SXM + CLM anydata birdseye brooklyn certa
convergepoint gatekeeper ignite itbid knovos
weproc

Sourcing + CLM aufait axya bidiful bonfire
cobblestone maistro prm360 safesourcing tradogram

Sourcing + SXM aerchain apadua archlet cimmra
cirplus cofactr inpromax k2 livesource
newtron oboloo opentrd pinpools pratis
procurekey procurementexpress promena prospeum qad
qcsolver sourcedogg srmeprocurement supplios teamprocure
tradebeyond truevaluehub valdera vendorful

Sourcing & Analytics curvo levadata requis

SXM & Analytics coglegal costbits everstream flowie
hivebuy lytica softconcis spendqube veridion

Contract Lifecycle Management (CLM) apporchid aavenir agiloft airflip
arteria atamis avvoka bonterms brightleaf
cipherace concord conga contracthound contractai
contractbook contractlogix contractpodai contracts365 contractsafe
dealsign docfield docjuris docusign dsilo
ebrevia evisort eyvo icertis inhubber
intelagree ironclad joro lawgeex legalrobot
legalsifter legartis lexcheck linksquares litera
luminance malbek opengov getoutlaw pocketlaw
pramata relativity simplicontract sirion spotdraft
terzo thinkingmachine thoughtriver tomorro trackado
trakti trueledger unimarket whitevision

Sourcing aestiva alpega amplio bamboorose
bestauction bideg bidlock bidso brainal
cosmoone enverus esupplier expenzing fairmarkit
keelvar lhotse loopio mysupply nextenders
onemoresource pagerduty partanalytics ply postrfp
procurementflow protendering responsive serex solvoz
sorcity supplychaincube supplyframe transfix wantex
zivio

Supplier Management (SXM) achilles adaptone agora alpas
apexanalytix aravo askafox auditcomply avetta
axiscope bedrock canopy cmx craft
creditriskmonitor enlightaspice eProcure eved exigis
franconnect ghx globality graphite grms
haloai hellios hicx informatica integritynext
interos isnetworld itesoft jiga kodiakhub
kyriba leanlinking lexisnexis linkana lupr
matchory mycomplianceoffice meshworks mfg opuscapita
orbweaver partnerelement paymentworks perimeter planergy
processunity procurence qmsc relatico resilinc
riskledger scoutbee silex smartkyc sourcemap
sphera stateofflux stimulus suppeco supplhi
supplierday supplierio suppliersoft supplyhive supplyrisksolutions
tacto tealbook thomasnet transcepta transparencyone
trustyoursupplier vendorapp vendorscoreit venminder zumen

Analytics acquireinsights aera akirolabs alteryx
analytics8 anaplan anvilanalytical calculum creactives
cxonexus deliciousdata digitate electrifai greencabbage
hunterai ivoflow kiresult metricinsights mithra
neqo onetrust oversight partnerling prgx
proaact procurevue pulse robobai rosslyn
scalue sievo silvon sourcinginsights spendata
spendboss spendedge spendhq spendkey smartcube
spendscape spendworx sps suplari tamr
vanta

Procure-to-Pay (P2P) b2be birchstreet b1p compleat
curemint dynatos elcom equallevel esker
ezatlas fraxion inbuild kissflow marketboomer
modernpo oracle orderco pagero pairsoft
payem precoro proceedo procuredesk procurenode
ramp settle softco sutisoft tradecentric
tradeshift vroozi

eProcurement bellwether bill brex causeway
controlhub cordis enkash factwise unanet
finexio fluentcommerce idas inorder lojistic
markit nimbi openenvoy payhawk procurementpartners
punnchoutcatalogs purchasingplatform sovra spendmap spendwise
teampay uppler vurbis yaydoo

Invoice-to-Pay (I2P) / Accounts Payable (AP) abby airbase apexpress appzen
aria avidxchange basware billtrust bluechain
candex concur coreintegrator corpay dataserv
directcommerce dooap edenred edicom emburse
ezcloud fiscal freshbooks getpaid glean
ipayables iqinvoice lexmark makershub mineraltree
nipendo nium opentext paid photoncommerce
procurify relish rillion sage servicenow
snapb2b snowfox sourceday spendconsole spendesk
stampli symbeo taulia tipalti xelix
xsuite yooz

EXPENSE airwallex deem expensify finetune
navan pleo pluto tangoe travelperk
worktrips

PAYMENTS & V/P-CARDS bluebean bottomline enable finix
payoneer previse transactis transfermate wise

Intake-Manage-Orchestrate
appian arkestro automationanywhere capto
celigo convergentis corvolo elementum focalpoint
levelpath netfira omnea ontra opstream
oro P2Cnnct pega pipefy pivot
procureai provalido qntrl sudozi tonkean
workfellow zflow zip

ESG/Carbon Scope 3
carbmee carbonaltdelete carbonanalytics carboncare
carbonchain carboncloud carbonfit carbonminds circularise
circulartree circulor climatecamp co2ai conserviceesg
cozero ctrls daato ditchcarbon ecovadis
emitwise greenkpi makersite measurabl minespider
responsibly sustainalytics trustrace veriforce verso
vertaeon watershed

Cyber Monitoring
cybersecurityintelligence securityscorecard

Direct Supply Chain
approve athingz contingent ensun
exiger exostar findmyfactory facturee frdm
genlots kreatize marvo gosupply nimbly
omx overhaul owlsolutions partfox partspace
prewave qstrat rapidratings sayari shouldcosting
supplywisdom trademo versedai visotrust whistic
wholechain xometry zetwerk

Legal
apperio brightflag bryter fulcrum
lawvu mitratech persuit thomsonreuters wolterskluwer

Marketing
agencymania alliansis decideware hhglobal
mtivity moosh rightspend

SaaS
appdirect apptio auvik beamy
bettercloud calero cledara cloudeagle diminish
entrio flexera flywl hudled lightyear
lumos nachonacho najar npi productiv
saasrooms sastrify setyl spendflow substly
torii trelica trgscreen tropic varisource
vendr vertice viio zluri zylo

Training
eveneum lavenir positivepurchasing

MarketPlaces
auxionize axiom bizeebuy cimple
collectivespend droppe faire growinco iap
joor kaleida mercadolibre partstrader procureafrica
produceiq rheaply smartequip sourceit unite
wescale

Intelligence
apriori aranca beroe bipsolutions
brightfield buynamics capella chai consource
convergencedata costdata cottrillresearch covalyze diprima
dnb easykost evpsolutions expana fareye
freightos freightender fuelme importyeti magayz
metalminer mtisystems nvelop pando paxly
moodysanalytics procureforce procurementiq shipsta sourceintelligence
sourceful sovos spikefli totalbid trax
truevaluehub trustpair xeneta

Does ProcureTech Generate Billions While Practitioners Lose Trillions?

A couple of weeks ago, THE REVELATOR, in his AI Whispering asked Why does the ProcureTech solution side of the table make billions, while the practitioner side loses trillions (and more)? And it’s a fair question. Because even though the practitioners don’t lose trillions on ProcureTech and ProcureTech consulting (as that’s only in the Billions), they DO lose Trillions on Tech and Tech Consulting that the ProcureTech Consulting and ProcureTech providers SHOULD be helping them save money on.

To be precise, at least 1.8 Trillion is going to be lost by Practitioners this year on Technology and Technology Consulting. Earlier this year, in our post on SaaS Spending, we predicted that at least 1.5 Trillion would be wasted based on total industry spend and an average waste of AT LEAST 30% (due to overspend, unused applications and project failure), but we are now revising that up to 1.8 Trillion based upon a minimum projected spend of 5.4 Trillion based on recent Gartner estimates.

To put this in perspective, only 15 countries have a GDP in excess of 1.8 Trillion! In other words, the total technology spend wasted is greater than the individual GDP of 92% of the countries on earth.

But it gets worse.

If you add up the global revenue of the 23 Big Consultancies, which you will be using for ProcureTech, FinTech, and related consulting, it comes to 551 Billion.

Accenture 65
Bain 7
BCG (Boston Consulting Group) 13
Capgemini 25
Cognizant 20
Deloitte 67
E&Y 51
Fujitsu 26
Genpact 5
HCL Technologies 14
Infosys 25
Kearney 2
KPMG 38
McKinsey 19
Mercer 2
NTT Data 30
Oliver Wyman 3
Publicis Sapient 18
PWC 55
Recruit 23
BAH (Booz Allen Hamilton) 1
Tata 31
Wipro 11

And if you add up the global revenues of the 9 big analyst firms, which you will be using for ProcureTech and Fintech advisory, it comes to 51.5 Billion.

Clarivate 0.5
Forrester 0.5
Gartner 6.5
Hackett 0.5
IDC 4.0
IQVIA 15.0
Kantar 3.5
Moodys 7.0
S&P 14.0

That’s a total of 602.5 Billion you’re spending for ProcureTech and FinTech consulting and advisory in return for a loss of roughly 1.8 Trillion!

In other words, for every dollar you spend, you lose three. That’s the reverse of the ROI you should be expecting. You should NOT be investing in Technology or Technology Consulting unless you will get a 3 to 1 return. But what you ARE doing is investing in Technology Consulting and Advisory for a 3 to 1 LOSS! That is the EXACT OPPOSITE of what you should be doing.

So what should you do? STOP!

Or, if you can’t stop, change the game. More to come …