Patrick Opet, the Chief Information Security Officer of JPMorgan Chase, has called on software companies to slow down and focus more on building secure systems rather than rushing their products to market. In a public letter, he warned that security gaps in third-party software are creating serious risks, especially as many global businesses now depend on just a handful of technology providers.
The Problem with Relying on External Vendors
Today’s companies use many third-party tools for essential services, from managing data to running operations. But this convenience also comes with danger. When even one of these vendors faces a security issue, it can affect not just one business—but many others connected to it.
Opet shared that JPMorgan has already dealt with several such incidents involving their outside service providers. In these cases, the bank had to respond quickly by cutting off access to the affected vendors and using large amounts of resources to fix the issue and prevent further harm.
Real Events Show the Risk Is Real
Earlier in 2024, the bank revealed that a software issue involving an external provider affected more than 451,000 people. In another case, a flawed software update from cybersecurity firm CrowdStrike caused a massive technical outage worldwide. This update caused millions of Windows devices to crash, affecting airlines, hospitals, banks, and more.
Why Attackers Target Third-Party Tools
Newer tech systems often use tools that connect different platforms to each other. While these tools improve efficiency, they also make it easier for hackers to get inside private company networks. Criminals are increasingly using this path to steal confidential information or disrupt services.
Opet pointed to recent reports showing how state-linked cyber groups are using cloud platforms and remote access software to get into systems and carry out their attacks.
What Needs to Change
Opet released his letter just before a large international cybersecurity conference in San Francisco. He hopes this message will inspire software makers to set higher safety standards, be more honest about how they manage sensitive access, and explore privacy-focused technologies that better protect user data.
His concerns match those of other experts who have also pushed for stronger security measures, including building protections directly into software from the start. Some industry professionals have even said legal accountability should be introduced if providers fail to protect their systems properly.