Topic starter
18/08/2026 2:24 pm
TL;DR: Software supply chain risk grew faster in 2024 and 2025, with H1 2026 on pace to surpass both years, because AI expanded development pipelines and attacker capabilities, according to StepSecurity. Trust now has to be governed across developer machines, repos, registries, and CI/CD runtime.
Editorial analysis by NHI Mgmt Group, based on content published by StepSecurity: “2026 Mid-Year Update: On Pace for Our Biggest Year Yet”.
By the numbers:
- StepSecurity says it closed roughly 7x more new customers in H1 2026 than in H1 2025.
Key questions
A: They can turn one trusted execution path into a launch point for lateral compromise.
Q: What are the signs that software supply chain controls are failing in practice?
A: Common warning signs include overreliance on vulnerability lists, weak visibility into third party dependencies, limited scrutiny of developer tooling, and no practical way to audit the full software estate.
Q: What breaks when software supply chain controls are only partially automated?
A: Partial automation creates inconsistent enforcement, which means some builds are protected while others slip through manual exceptions or forgotten paths.
Practitioner guidance
- Segment controls by pipeline stage Apply different controls to developer endpoints, source control, package intake, and CI/CD execution so compromise at one stage does not automatically extend to the next.
- Inventory non-human credentials across the delivery chain Track workflow tokens, publishing credentials, runner secrets, and package-scoped permissions with the same discipline used for privileged human access.
- Block newly published packages from immediate trust Use cooldown or verification gates before fresh dependencies can execute on developer machines or enter CI/CD builds.
Bottom line: AI has accelerated software supply chain compromise by expanding both the volume of shipped code and the speed of attacker tradecraft.
Glossary terms: Software Supply Chain Security, Non-Human Identity (NHI), Pipeline Trust Gap, Package Cooldown Window
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:15 pm
AI has turned software supply chain governance into a trust orchestration problem. The core issue is no longer whether one layer can block a malicious package. It is whether organisations can coordinate controls across developer machines, repos, registries, and CI/CD with enough consistency to stop a poisoned dependency from becoming a production event. Practitioners should treat trust orchestration as a first-class security capability.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams govern autonomous coding agents in software delivery pipelines?
A: Treat the agent, its sandbox, and its tool access as a single governed execution path. Require per-run identity, scoped credentials, signed triggers, and human approval before merge. The key is not to stop automation, but to ensure every autonomous action has a bounded lifecycle, a clear owner, and an auditable trail from trigger to release.
👉 Read our full editorial: AI changed software supply chain risk faster than controls can adapt