Notifications
Clear all
Topic starter
02/08/2026 12:29 pm
TL;DR: Software supply chain attacks are accelerating as teams rely on ecosystems that make up 70 to 90% of modern applications, while 60% of large enterprises already deploy SSCS tools and Gartner expects that to reach 85% by 2028, according to Veracode's reading of Gartner research. The practical issue is not just provenance, but whether identity, policy, and automation can keep pace with fragmented build and delivery trust.
NHIMG editorial — based on content published by Veracode: Software supply chain attacks in 2025, what we learned from Gartner
By the numbers:
- Much software relies on open-source software and vendor components that often make up 70 to 90% of a modern application.
Questions worth separating out
Q: How should security teams govern machine identities in software supply chains?
A: They should treat machine identities as first-class supply chain assets with owners, expiry rules, and revocation paths.
Q: Why do software supply chain attacks create an IAM problem?
A: Because attackers frequently abuse trusted access paths rather than exploit the application itself.
Q: What breaks when organisations rely only on vulnerability scanning in SSCS?
A: Vulnerability scanning finds known flaws in dependencies, but it does not prove that a package is authentic, approved, or untampered.
Practitioner guidance
- Inventory CI/CD non-human identities Map service accounts, tokens, signing keys, package registry credentials, and automation identities used across build and release systems.
- Enforce provenance before release Require signed artefacts, verified package sources, and SBOM-backed traceability before code can move from build to production.
- Automate policy gates in the pipeline Use automated controls to block unapproved dependencies, detect misconfigurations, and prevent unauthorized access to SDLC tooling.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- How Veracode SCA handles reachability analysis, SBOM generation, and binary scanning in real application pipelines.
- How Package Firewall enforces package approval and blocks unapproved artefacts before they enter CI/CD.
- How the vendor maps its capabilities to software delivery, post-deployment traceability, and compliance workflows.
- How the Gartner Market Guide is being used to frame SSCS tool selection and control priorities.
👉 Read Veracode's analysis of Gartner's 2025 software supply chain security guide →
Software supply chain attacks in 2025: are identity controls keeping up?
Explore further
02/08/2026 1:27 pm
Software supply chain security is now an identity governance problem as much as a code integrity problem. The article correctly frames SSCS as a trust issue across development, delivery, and post-deployment, but the identity surface is what lets attackers turn trust into action. Service accounts, API keys, signing privileges, and CI/CD access often sit outside the controls that IAM teams apply to human users. Practitioners should treat delivery tooling identities as production-grade assets, not developer convenience accounts.
A question worth separating out:
Q: Which control should teams prioritise first in software supply chain governance?
A: Prioritise the control that reduces trust ambiguity in the pipeline. In most environments that means artefact signing, verified package sources, and strict access control for build and release identities. If teams cannot prove who or what changed a component, incident response and compliance both become slower and less reliable.
👉 Read our full editorial: Software supply chain attacks in 2025 expose identity blind spots
