Notifications
Clear all
Topic starter
21/08/2026 4:48 pm
TL;DR: Enterprise software is still dominated by open source, with 85% of code bases relying on it, while 235,000+ CVEs with known fixes were identified from 2016 to 2025 and active exploitation can begin within 10 hours of disclosure, according to Rapidsort. The operational lesson is that vulnerability reduction and runtime evidence matter more than post-deployment detection when sensitive-data sectors need both resilience and auditability.
NHIMG editorial — based on content published by Rapidsort: Navigating the Evolving Threat Landscape and reducing software supply chain risk
By the numbers:
- 85% of enterprise software is open source
- 10 hrs from vulnerability disclosure to active exploit
- RapidFort says its platform can reduce the attack surface by up to 90%
Questions worth separating out
Q: How should security teams prioritise software supply chain vulnerabilities?
A: Prioritise by exploitability, reachability, and runtime exposure rather than total CVE volume.
Q: Why does runtime evidence matter in compliance programmes?
A: Runtime evidence shows what is actually executing, which is more reliable than static inventory alone when auditors or risk teams need proof of control effectiveness.
Q: Why do software supply chain controls fail when tools are not integrated?
A: They fail because each tool may identify risk, but no single owner can turn that evidence into a release decision.
Practitioner guidance
- Implement exploit-aware prioritisation Use SBOM data, reachability checks, and runtime context to rank vulnerabilities by actual exposure instead of raw CVE counts.
- Add runtime verification to compliance evidence Capture runtime bills of materials and benchmark output so audits can reflect what is actually executing in production.
- Harden container intake and build gates Block unapproved base images and reduce unused packages before deployment so risk is removed upstream rather than patched later.
What's in the full article
Rapidsort's full white paper covers the operational detail this post intentionally leaves for the source:
- Specific breakdown of RapidFort Curated Images, Analyzer, Optimizer, Profiler, and CART across the software lifecycle
- Audit-ready evidence examples for CIS, STIG, NIST 800-53, FedRAMP, SOC 2, PCI DSS, and NIS 2
- How the platform positions exploit-aware scoring and runtime profiling in regulated environments
- Implementation framing for reducing attack surface without code changes
👉 Read Rapidsort's white paper on eliminating software supply chain risk at the source →
Software supply chain risk and compliance: what practitioners need to act on?
Explore further
21/08/2026 5:07 pm
Risk elimination beats alert-driven remediation in software supply chains. The paper reflects a market shift away from hoping scanners will keep pace with exposure windows. In sectors that process sensitive data, the question is no longer whether a vulnerability exists but whether the organisation can remove it before exploitability becomes operational. That is a governance problem as much as a tooling problem, and it rewards lifecycle control over post-fact response.
A question worth separating out:
Q: How do security and compliance teams work together on software risk?
A: They should share one evidence model that ties hardening, vulnerability reduction, and runtime validation to audit requirements. Security teams reduce exposure, while compliance teams need proof that those controls persist in production. When both use the same facts, manual evidence gathering drops and control assurance improves.
👉 Read our full editorial: Software supply chain risk shifts from detection to elimination
