Topic starter
18/08/2026 2:24 pm
TL;DR: Third-party involvement in breaches rose from 15% to 30% in a year, according to ArmorCode. SBOMs and VEX only help when teams use them to sort reachable risk from noise.
Editorial analysis by NHI Mgmt Group, based on content published by ArmorCode: “Software Supply Chain Security: A Strategic Guide to SCA, SBOMs, and Risk Prioritization”.
Key questions
Q: Why do SBOMs need VEX and asset context to be useful?
A: Because an SBOM is only an inventory.
Q: What breaks when supply chain teams rely on scanner severity alone?
A: They get a backlog of high-volume findings with no reliable way to tell what is reachable, exploitable or business-critical.
Practitioner guidance
- Define a supply chain prioritisation model Rank findings by exploitability, exposure and asset criticality rather than by scanner severity alone so teams know what to fix first.
- Ingest SBOMs into a single control plane Normalise CycloneDX, SPDX and other SBOM formats into one view so component inventory, ownership and exposure can be assessed together.
- Require VEX before escalating every flagged CVE Use affected, not affected, fixed and under investigation status to suppress dead-end alerts and focus analyst effort on reachable risk.
Bottom line: Software supply chain security fails when organisations treat SCA output as the end state rather than the start of decision-making.
Glossary terms: Software Supply Chain Security, SBOM, Vex, Continuous Threat Exposure Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:14 pm
Risk-based prioritisation is now the control that makes supply chain security operable. The article is right to move beyond raw severity scoring because CVSS does not answer whether a component is reachable, exposed or business-critical. That gap is why teams drown in findings and still miss the handful that matter most. Practitioners should treat prioritisation as a governance control, not a reporting function.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why do SBOMs need VEX and asset context to be useful?
A: Because an SBOM is only an inventory. VEX and context tell you whether a flagged component is actually affected, whether the vulnerable code path is reachable and whether the asset matters enough to prioritise. Without that layer, an inventory becomes compliance paperwork instead of a remediation tool.
👉 Read our full editorial: Software supply chain security needs risk-based prioritization