Third-Party Vendors Represent Primary Attack Vector in Gaming Cybersecurity

Third-party vendors constitute the leading source of cyberattacks against casino operators. David Elmore, Head of Commercial Services, North American Casinos at Gaming Laboratories International, cited research from the Tribal Information Sharing and Analysis Center showing about 80 per cent of attacks occur through these suppliers. The data came from a survey of approximately 300 respondents across around 90 tribal organisations.

Elmore shared these findings with G3 Newswire during G2E in Las Vegas. Casino environments now incorporate more than 180 different systems, including hotel management platforms, point-of-sale terminals, building controls and payment infrastructure. Each link expands the attack surface, while suppliers maintain their own unseen chains of developers, cloud services and sub-partners.

Gaming-Specific Security Frameworks

Gaming Laboratories International developed the GLI Gaming Security Framework to adapt principles from the Center for Internet Security and the US National Institute of Standards and Technology to regulated gaming operations. The framework contains dedicated modules for vendor security, land-based gaming and online gaming. Its Vendor Security Program delivers independent assessments covering governance, technical controls and penetration testing.

This structure reduces the burden of repeated customer questionnaires while providing operators a consistent evaluation baseline. Existing standards such as SOC 2 Type II and ISO 27001 lack the sector specificity required. Security assessments must extend beyond initial procurement because vulnerabilities persist after integration and can emerge with updates or new connections.

Rising AI-Driven Threats and Operational Responsibility

Right now, you see 71,000 attacks per minute worldwide. Elmore warned that by 2027, that could be three to ten times as many attacks because of AI. Defensive systems increasingly rely on AI to filter alerts for human review, yet sophisticated intruders may dwell undetected inside networks to map policies and escalate privileges.

Cybersecurity cannot remain an IT-only function. Every employee must recognise social engineering and phishing risks. Boards face the persistent difficulty of justifying preventive spending when measured against immediate revenue opportunities. Incidents at MGM Resorts and Caesars Entertainment in 2023 elevated awareness without producing the anticipated industry-wide reassessment.

Operators must scrutinise vendor relationships more closely over the next 12 months. Continuous internal scanning and periodic external reviews form an operational necessity rather than a compliance checkbox. The industry cannot treat security as a one-time exercise while expanding interconnected technologies.