Topic starter
02/08/2026 11:24 am
TL;DR: Third-party code and AI-assisted development expand software supply chain exposure faster than manual review can track, according to Veracode. Build trust now depends on governing the identities and secrets that move through CI/CD and other automation.
Editorial analysis by NHI Mgmt Group, based on content published by Veracode: “Top Software Supply Chain Security Best Practices for Enterprises”.
By the numbers:
- 66% of the most critical, long-lived vulnerabilities in enterprise applications originate from third-party code, according to Veracode.
- Only 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog were fully remediated, according to Veracode.
- The median time to full resolution climbed to 43 days, according to Veracode.
Key questions
Q: Why do transitive dependencies create more risk than teams expect?
A: Transitive dependencies are often invisible to the developer who triggered them, but they still become part of the shipped application.
Q: What are the signs that software supply chain controls are failing in practice?
A: Common warning signs include overreliance on vulnerability lists, weak visibility into third party dependencies, limited scrutiny of developer tooling, and no practical way to audit the full software estate.
Q: What breaks when non-human identities are not governed in software supply chains?
A: When non-human identities are not governed, attackers can use tokens, service accounts, and secrets to reach build, release, and data systems that were never meant to be exposed together.
Practitioner guidance
- Govern pipeline and registry identities as privileged assets Map every service account, token, signing key and bot that can approve, publish or deploy software, then remove standing access wherever possible.
- Block unapproved dependency ingestion at the build boundary Enforce policy on package sources, publisher trust, typosquatting and transitive dependency approval before code enters the build.
- Require provenance evidence for build outputs Adopt artifact signing, build attestations and source-to-binary traceability so release trust depends on verifiable origin rather than post-build inspection.
Bottom line: Software supply chain security is now inseparable from identity governance because build and release paths rely on privileged non-human actors.
Glossary terms: Software Supply Chain Security, Transitive Dependency, Build provenance, Machine Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 12:41 pm
Software supply chain security has become a machine identity governance problem. The article is right to move beyond code review and scanning because build systems, registry publishers and automation bots are the actors that now control software movement. When those identities are overprivileged or long-lived, compromise becomes a distribution event rather than an isolated incident. Practitioners should manage pipeline identities with the same rigor they apply to privileged human accounts.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams balance SLSA and SBOM requirements in software delivery?
A: SBOMs tell you what components are present, while SLSA addresses whether the artifact itself can be trusted. Teams should use both: SBOM for inventory and vulnerability response, SLSA for build provenance and tamper resistance. Together they create a fuller control picture than either one alone, especially when third-party and AI-assisted code are both in play.
👉 Read our full editorial: Identity controls define software supply chain trust
This post was modified 2 days ago by NHI Mgmt Group