What procurement finds out about you before it calls.

This week someone in public procurement explained to me what they find out about a new supplier before the first call. I had expected the website. It is part of it, but only a part.

Before the procurement process proper comes a market analysis, and it is extended by a check across the whole net: what can be found about the company online, is anything about the firm circulating on the dark web, are there compromised accounts? Only when things get concrete and confidential information is involved do formal security procedures for the company and security clearances for individual staff follow.

The remarkable part is the timing. The check runs before the supplier knows it is even being considered. If it fails, it never finds out. Nobody calls.

In the night to 12 October 2026, the refrigeration systems of supermarkets in France were tampered with. Through networked controllers made by Danfoss, the attackers raised temperatures and started defrost cycles. About 500 stores of several large retail chains are reported affected. Frozen and fresh goods had to be thrown away, and the Paris prosecutor is investigating.

The vulnerabilities in these controllers had been public since August. Security researchers had also found more than 2,700 controllers reachable directly from the internet, and according to the manufacturer the affected devices ran outdated software. So what was attacked was not the supermarkets' IT, but a supplier's networked equipment inside their stores.

The current study “Cybersecurity in Österreich 2026” by KPMG and the Kompetenzzentrum Sicheres Österreich (KSÖ), which surveyed almost 1,400 Austrian companies in February and March 2026, shows the same pattern:

More than one company in five has already been attacked through a supplier. Buyers looking more closely is not a formality; it is a response to that.

Since 1 October 2026 Austria's NISG 2026, the national implementation of the EU NIS2 Directive, has been in force. It obliges about 4,000 companies in critical sectors to take security measures, and supply-chain security is explicitly one of them. The Austrian Economic Chamber points out what this means for everyone else: the requirements are passed down the supply chain to suppliers and service providers, usually through contracts. Tens of thousands of smaller businesses are affected indirectly, though the law does not cover them.

Companies that make products with digital elements also have the EU Cyber Resilience Act. Since 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe security incidents; from 11 December 2027 the regulation applies in full.

For a supplier this means: the question about its own security does not first come up in an audit. It comes in the questionnaire before the contract is awarded, and before that in a check it never notices.

There are dedicated providers for automated supplier checks, so-called security rating platforms. They rate companies from the outside, without access to their systems, using only what is publicly observable: DNS records, certificates, email settings, open ports. One widely used provider groups its checks into ten areas:

Four of these ten areas concern your website and your domain directly: website security, encryption, email and DNS. At the end there is a rating. Whether anyone reads the individual findings behind it is up to the person checking, not to you.

I am not a security expert. Penetration tests, leak monitoring and NISG compliance need specialists, and they exist. But one part of this check is entirely in your own hands, and it is exactly the part a buyer sees first: your website.

• Maintained, not merely present. A website whose software has not been updated for years shows up in every outside check. It is usually also the only part of your systems that any stranger can look at.
• A contact for security questions. Naming on the website where security reports should go shows that someone is responsible. There is even a standard for it, the security.txt file.
• Your email domain. Whether your domain is protected against forged senders can be checked from outside in seconds. Ask your IT about it; it is usually not a big project.
• The same company as in the conversation. Certifications, industries, contacts and datasheets should appear on the website as you would state them in the first conversation. A check that finds contradictions does not become more generous.

Procurement checks you before it calls, and not only your website. Most of that check you cannot steer, except through good security behind the scenes. The website you can steer. It is the one thing a buyer is certain to see of you, and it should match the company they are about to meet on the phone.