A Multi-State Linear Influence Model for Cyber Risk Propagation in Supply Chains

Modern multi-echelon supply chains of critical infrastructure are increasingly defined by hyper-connectivity, driven by software integrations, cloud-based architectures, and enterprise resource planning synchronization. While these digital integrations optimize operational throughput, they simultaneously expose industrial networks to systemic, cascading cyber risks. Traditional supply chain risk management paradigms are often inadequate to capture the time-varying, multi-stage degradation characteristics of cyber threat propagation through the chain. This article introduces a baseline cyber risk propagation framework that couples a linear influence model (LIM) paradigm with a discrete 4-state operational security condition: Secure, Vulnerable, Compromised, and Offline. The proposed architecture leverages the additive and time-decaying properties of LIM frameworks to inherently resolve cyclic operational feedback loops while bypassing exponential state-space explosion. To operationalize the mathematical framework, we investigate four core resilience metrics: time-to-impact, area under the curve, cyber bullwhip effect, and recovery lag. Numerical simulations demonstrate the feasibility of this computationally tractable framework on synthetic networks, illustrating how it can be used to audit cascading propagation, evaluate containment strategies, and compare mitigation policies across multi-echelon ecosystems.