Topic starter
20/08/2026 5:24 pm
TL;DR: OWASP’s 2025 Top 10 ranked software supply chain failures #3 with 106 first-place votes, a consensus signal that the category has moved beyond patched dependencies to compromised build systems, poisoned pipelines, and client-side runtime risk, according to Jscrambler. The practical shift is clear: visibility must extend from CI/CD inventories into what actually executes in users’ browsers, where conventional appsec controls still leave major blind spots.
Editorial analysis by NHI Mgmt Group, based on content published by Jscrambler: “OWASP’s Biggest Signal in Years: Supply Chain Is Now a Top-3 Risk — And It Includes the Client Side”.
By the numbers:
- Software Supply Chain Failures received 106 first-place votes out of 212 respondents in OWASP’s 2025 Top 10 update.
- OWASP surveyed 225 security practitioners for the 2025 Top 10 update.
Key questions
Q: What breaks when software supply chain controls are not built into DevSecOps pipelines?
A: When supply chain controls sit outside the pipeline, teams lose visibility into what actually enters builds, and malicious or vulnerable dependencies can pass through as trusted inputs.
Q: Why do browser-executed third-party scripts create supply chain risk?
A: Because they run inside the user’s session with access to page content, form fields and behavioural signals.
Q: How can security teams measure whether supply chain controls are actually working?
A: Look for reduced use of long-lived publishing tokens, fewer workflows with broad secrets access, lower dependency auto-update exposure, and faster revocation after compromise.
Practitioner guidance
- Map the browser script estate Build a continuously updated inventory of every first-party and third-party script executing on high-risk pages, including tag managers and dynamically loaded resources.
- Monitor script behaviour at runtime Detect unauthorized modifications, data access patterns and suspicious script actions after deployment, not only at scan time or during release approval.
- Separate build assurance from execution assurance Keep SBOM and dependency scanning in place, but add runtime controls that confirm the live page matches the trusted build and its intended behaviour.
Bottom line: Software supply chain risk now extends beyond dependency management into the runtime behaviour of code that executes in users’ browsers.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:14 pm
Runtime exposure is now the real supply chain problem: the category no longer ends at dependency hygiene or signed builds. Once third-party code executes in the browser, security ownership shifts to behaviour, trust scope and live control. Practitioners should stop treating client-side execution as a presentation-layer detail.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: When should organisations prioritise runtime script governance over dependency scanning?
A: When customer-facing pages rely on third-party tags, CDNs or browser-loaded content that can change independently of the release pipeline. In that situation, dependency scanning remains necessary, but runtime governance becomes the control that protects the live attack surface.
👉 Read our full editorial: OWASP A03 now frames software supply chain risk as runtime exposure