The problem
Every supply chain has a weak link
Modern software is assembled from thousands of dependencies, build steps, and third-party services. Each one is a place an attacker can hide. Here's the terrain we teach people to defend.
The attack surface
What We're Defending
The software supply chain spans everything between writing code and running it in production — dependencies, build systems, package registries, deployment pipelines, and the trust relationships that connect them all. Each link is a potential attack vector.
Dependencies & Registries
Every import pulls in code from strangers. Typosquatting, dependency confusion, and malicious updates target the packages developers trust implicitly.
Build Pipelines & CI/CD
Build systems run with elevated privileges and produce the artifacts that ship to production. A compromised workflow injects code no review will catch.
Provenance & Artifact Integrity
Without signed builds and verified attestations, you're trusting the entire path from source to production on faith. Provenance proves what you built is what you deploy.
Bills of Materials
SBOMs track software components. C-BOMs map cryptographic implementations. CI-BOMs document build pipeline dependencies. AI-BOMs capture model provenance. You can't defend what you haven't inventoried.
Vendor & Third-Party Risk
Your vendor's security posture is your security posture. A compromised software provider means every customer downstream inherits the breach.
Transitive Dependencies
Your app uses A, which uses B, which uses C. A vulnerability three layers deep — invisible to your team, absent from your scans — is still your vulnerability.
Know what you ship
Bills of Materials
Every application is built from thousands of invisible components — libraries, algorithms, models, and services. BOMs make that invisible supply chain visible. You can't defend what you haven't inventoried.
Software Bill of Materials
A complete inventory of every component and dependency in your software. The foundation — you can't patch what you can't see.
Cryptographic Bill of Materials
Maps every cryptographic algorithm, certificate, and key in your stack. Essential for knowing what breaks when quantum arrives.
AI / ML Bill of Materials
Tracks model provenance, training data lineage, and inference dependencies. Know where your models came from and what shaped them.
Quantum Bill of Materials
Identifies which cryptographic implementations are quantum-vulnerable and tracks your migration to post-quantum algorithms.
Looking ahead
Quantum-Ready Supply Chains
Quantum computing won't just break encryption — it will undermine the trust infrastructure that holds the entire software supply chain together. The transition to post-quantum cryptography has already begun.
Harvest Now, Decrypt Later
Adversaries are already collecting encrypted data today, waiting for quantum computers to crack it. Long-lived secrets are at risk right now.
Trust Infrastructure at Stake
Code signing, TLS, build attestation, and package verification all rely on algorithms quantum computers will break. The entire supply chain trust model is affected.
Crypto Agility Is the Answer
NIST has finalized post-quantum standards (ML-KEM, ML-DSA). The real defense is building systems that can swap algorithms without rewriting applications.
Beyond software
Supply Chain Risk Is Everywhere
Supply chain attacks aren't just about npm packages. Every industry has its own supply chain — and every one of them is a target. The convergence of physical and digital means a breach in one sector cascades across all of them.
Food & Agriculture
Farm-to-fork traceability, cold chain integrity, and food fraud — a contamination or cyber attack cascades before anyone detects it.
Pharma & Healthcare
Counterfeit drugs, API sourcing concentration, and vaccine cold chains — where supply chain failure costs lives.
Semiconductors
Chip fabrication concentrated in Taiwan, hardware trojans, and firmware attacks that no software scan will catch.
Energy & Utilities
Decades-old SCADA systems, smart grid IoT, and OT networks where a compromised control system causes physical damage.
Automotive
100M+ lines of code per vehicle, OTA update infrastructure, and tier-2 suppliers with no software visibility.
Telecom
5G vendor concentration, SIM supply chain attacks, and undersea cables — the backbone of everything else.
Manufacturing
Opaque PLC firmware, just-in-time inventory with zero buffer, and compromised CAD files that weaken physical parts.
Financial Services
SWIFT network risks, open banking API sprawl, and core banking vendor concentration serving thousands of institutions.
Aerospace & Defence
Multi-tier classified supply chains, counterfeit avionics components, and firmware integrity for mission-critical flight systems and weapons platforms.
Drones & Unmanned Systems
GPS spoofing, compromised flight controllers, foreign-sourced firmware in commercial drones, and C2 link interception across autonomous fleets.