Topic starter
18/08/2026 2:34 pm
TL;DR: Only 28% of respondents have strong insight into transitive dependency layers, leaving roughly 72% of organisations making security decisions on an incomplete view of their software supply chain, according to Kusari's Application Security in Practice report. That visibility gap turns SCA into a partial control, not a full answer, because nested components can change between scans and evade remediation.
Editorial analysis by NHI Mgmt Group, based on content published by Kusari: “Why 72% of Organizations Can't See Their Real Attack Surface: Solving the Transitive Dependency Visibility Gap”.
By the numbers:
- Only 28% of respondents feel they have strong insight into their transitive dependency layers.
- 47% of teams spend more than 5 hours per week on supply chain security remediation.
Key questions
Q: What breaks when transitive dependency visibility is missing?
A: Teams lose the ability to see most inherited software risk, so scans overstate confidence and understate exposure.
Q: Why do transitive dependencies create such a large security problem?
A: Because most teams do not install every library directly, they inherit risk through frameworks, plugins, and bundled components they may not know are present.
Q: How do security teams know if dependency controls are actually working?
A: Look for whether build systems prevent unauthorised version drift, whether package provenance is checked before install, and whether secret-handling code is isolated from broad application reach.
Practitioner guidance
- Implement full dependency graph inventory Map direct and transitive components across every package ecosystem in use, then keep the inventory current enough to support vulnerability and compliance decisions.
- Move from build-time scans to continuous monitoring Track newly disclosed vulnerabilities across nested packages between releases so a transitive issue does not sit undiscovered until the next scan cycle.
- Use reachability to prioritise remediation Confirm whether the vulnerable function is actually invoked before escalating work, especially where a transitive issue could generate large alert volumes.
Bottom line: The article shows that transitive dependency exposure is mainly a visibility problem, not a lack of scanners.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:21 pm
Transitive dependency visibility is now a governance control, not a tooling preference. The article shows that teams can have SCA in place and still lack the information needed to make defensible security decisions. That is a control-design problem, not just a scanning problem, because the organisation is making judgments about code it cannot fully enumerate. Practitioners should treat full dependency visibility as a prerequisite for credible supply chain governance.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations prioritise transitive dependency mapping or more SCA tools?
A: They should prioritise transitive dependency mapping first. Adding more scanners rarely fixes the core problem if the organisation still cannot see the full graph or keep it current between builds. Better governance comes from complete inventory, continuous monitoring, and clear remediation ownership, not tool sprawl.
👉 Read our full editorial: Transitive dependency blind spots are leaving most apps exposed