Notifications
Clear all
Topic starter
02/08/2026 11:23 am
TL;DR: As supply chain attacks accelerate and nearly a third of known vulnerabilities are exploited on or before disclosure, the governance challenge is no longer just finding vulnerable dependencies, but controlling how fast organisations can patch them without creating new operational risk, according to Aikido.
NHIMG editorial — based on content published by Aikido: Aikido acquires Root to secure the supply chain
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
A: The main failure is operational.
Q: Why do build and release pipelines create identity risk in supply chain security?
A: Because they are governed by non-human identities with broad access to code, registries, and deployment systems.
Q: How do security teams know whether patching is keeping up with real risk?
A: Patching is keeping up only when the most recently exploited vulnerabilities are being closed quickly and the backlog of exposed assets is shrinking.
Practitioner guidance
- Establish patchability SLAs Set separate service-level targets for discovery, test, and deployment so remediation speed is measured independently from vulnerability detection.
- Inventory non-human identities in build and release pipelines Map the service accounts, tokens, and API keys that can create, modify, or publish packages and images.
- Validate patch provenance before rollout Require signed builds, reproducible patch artefacts, and approval checkpoints for any fix that is generated automatically.
What's in the full analysis
Aikido's full post covers the operational detail this analysis intentionally leaves for the source:
- How Aikido Libraries and Aikido Images are intended to patch the package and container versions teams already run.
- The specific production promise around avoiding breaking changes when generating version-matched fixes.
- Why upstream contribution of critical fixes matters for open source maintainers and ecosystem-wide remediation.
- How the Root acquisition is positioned alongside Aikido's existing supply chain security workflow.
👉 Read Aikido's post on acquiring Root for supply chain patching →
Software supply chain patching after Aikido and Root: what changes?
Explore further
02/08/2026 12:40 pm
Speed is now a governance control, not just an engineering metric. The article reflects a market shift in which the pace of remediation becomes part of security design. If teams cannot patch exploited dependencies fast enough, inventory and alerting do not meaningfully reduce risk. For practitioners, that means remediation throughput has to be measured as an operational control.
A question worth separating out:
Q: Should organisations trust agent-native patching for production remediation?
A: Only with guardrails. Agent-native patching is useful when the organisation can validate output, constrain privileges, and prove the provenance of each change. Without those controls, the same automation that accelerates remediation can also widen the trust boundary around code generation, release, and deployment.
👉 Read our full editorial: Aikido acquires Root: supply chain patching and NHI risk
