Software supply chain security is no longer just about knowing which open-source libraries are in your applications. Attackers are compromising developer environments, build systems, trusted distribution channels, and even security tools such as container security and infrastructure-as-code scanning tools. AI now adds another layer of dependencies to evaluate and protect. The result is an interconnected ecosystem where a compromise upstream can quickly become your organization’s problem downstream.

The business impact is substantial. According to Forrester’s Security Survey, 2026, security decision-makers who experienced a breach in the past 12 months report that, on average, their data breaches have cost a total of $2.9 million over the past 12 months. Those who experienced a breach involving the software supply chain reported greater costs, averaging $3.9 million. Supply chain compromises can damage customer trust, affect revenue and profits, and expose organizations to litigation.

 

My new report, Software Supply Chain Security Best Practices For Producers, Operators, And Choosers, examines how organizations can address these risks across the software lifecycle and the responsibilities of each role:

  • Producers, who create software and must protect the development practices and infrastructure behind it
  • Operators, who deploy, configure, maintain, and monitor software in the enterprise environment
  • Choosers, who select software and evaluate whether suppliers and products meet the organization’s business and security requirements

These roles often overlap, but each carries different responsibilities for managing risk.

A couple of takeaways from my new report:

  • Treat software supply chain security as a team sport. Securing the software supply chain is not just application security’s job. Development, IT, procurement, legal, risk, and business leaders all influence which software enters the organization, how it is built and deployed, and how risk is managed over time. The challenge is getting these teams to operate from the same strategy.
  • Make your SBOMs actionable, not decorative. Producing or obtaining a software bill of materials (SBOM) is an important step. Simply storing one is not a security outcome. Organizations must use SBOM data to identify changing risks, assess dependencies, and support decisions about remediation and software selection. As programs mature, leaders should look beyond their quantity of SBOMs and ask whether the information is complete, usable, and improving risk management.
  • Protect the systems behind the software. Software supply chain security depends on more than the security of individual components. Development environments, source code repositories, build systems, continuous integration and continuous delivery pipelines, credentials, and release processes are valuable targets because compromising them can give attackers a trusted route to downstream users. Security leaders must examine the infrastructure and processes behind software delivery, not just the finished product. AI coding agents and agentic development make that examination more urgent by introducing models, plug-ins, agent skills, MCP servers, and other components that may fall outside established controls.

Move Beyond The Inventory

Want to dive deeper into securing your software supply chain? Read Software Supply Chain Security Best Practices For Producers, Operators, And Choosers, and schedule a guidance session or inquiry with me to discuss how the research applies to your software ecosystem and priorities.

Share