Your Software Supply Chain Risk Doesn’t Stop At Your Suppliers

Software supply chain security is no longer just about knowing which open-source libraries are in your applications. Attackers are compromising developer environments, build systems, trusted distribution channels, and even security tools such as container security, and  IAC scanning tools. AI now adds another layer of dependencies to evaluate and protect. The result is an interconnected ecosystem where a compromise upstream can quickly become your organization’s problem downstream.  

And the business impact is substantial. According to Forrester’s Security Survey, 2026, security decision-makers who experienced a breach in the past 12 months report that, on average, their data breaches cost a total of $2.9 million over the past 12 months. Those who experienced a breach involving the software supply chain reported greater costs, averaging $3.9 million. Supply chain compromises can damage customer trust, affect revenue and profits, and expose organizations to litigation.  

My new report, Software Supply Chain Security Best Practices For Producers, Operators, And Choosers, examines how organizations can address these risks across the software lifecycle and the responsibilities of each role:  

• • Producers, who create software and must protect the development practices and infrastructure behind it. 
  • Operators, who deploy, configure, maintain, and monitor software in the enterprise environment. 
  • Choosers, who select software and evaluate whether suppliers and products meet the organization’s business and security requirements. 

These roles often overlap, but each carries different responsibilities for managing risk.  

A couple of takeaways from my new report: 

• • Treat Software Supply Chain Security as a Team Sport. Securing the software supply chain is not just application security’s job. Development, IT, procurement, legal, risk, and business leaders all influence which software enters the organization, how it is built and deployed, and how risk is managed over time. The challenge is getting these teams to operate from the same strategy.  
  • Make Your SBOMs Actionable, Not Decorative. Producing or obtaining an SBOM is an important step. Simply storing one is not a security outcome. Organizations must use SBOM data to identify changing risks, assess dependencies, and support decisions about remediation and software selection. As programs mature, leaders should look beyond their quantity of SBOMs and ask whether the information is complete, usable, and improving risk management. 
  • Protect The Systems Behind the Software. Software supply chain security depends on more than the security of individual components. Development environments, source code repositories, build systems, CI/CD pipelines, credentials, and release processes are valuable targets because compromising them can give attackers a trusted route to downstream users. Security leaders must examine the infrastructure and processes behind software delivery, not just the finished product. AI coding agents and agentic development make that examination more urgent by introducing models, plug-ins, agent skills, MCP servers, and other components that may fall outside established controls.  

Move Beyond The Inventory 

Want to dive deeper into securing your software supply chain? Read  Software Supply Chain Security Best Practices For Producers, Operators, And Choosers, and schedule a guidance session or inquiry with me to discuss how the research applies to their software ecosystem and priorities.