Supply Chain and Third-Party Risk Management

Software supply chain attacks tripled in 2025. The pattern is well understood: rather than targeting a hardened enterprise directly, adversaries compromise a trusted vendor and ride that trust relationship into hundreds of downstream victims simultaneously. SolarWinds, Log4j, the XZ Utils backdoor — each demonstrated that the supply chain is the most force-multiplied attack vector available.

How supply chain attacks are evolving in 2026

Three patterns dominate: software build pipeline compromise (injecting malicious code into signed release artifacts), open-source package hijacking via typosquatting and maintainer account takeovers, and SaaS-to-SaaS attack chains where one compromised platform pivots through legitimate API integrations into connected services.

Managing open-source dependency risk

An SBOM (Software Bill of Materials) for every application you build or buy is now essential infrastructure — it enables rapid response when a new CVE affects a dependency and is increasingly required by regulators. Tools like Syft, SPDX, and CycloneDX make SBOM generation tractable; the challenge is operationalising SBOM data into your vulnerability management workflow.

• Tier vendors by access level and data sensitivity. Apply heightened controls to Tier 1 vendors with privileged access.
• Require vendors to notify you of security incidents within 24–48 hours contractually.
• Generate SBOMs for all in-house software and require them from software vendors.
• Run dependency confusion and typosquatting checks against your package registries.
• Continuously monitor critical vendors' external attack surfaces.