Notifications
Clear all
Topic starter
02/08/2026 12:17 pm
TL;DR: OWASP’s Top 10:2025 moves Software Supply Chain Failures to third place, reflecting upstream compromise patterns such as dependency substitution, tampered build pipelines and unvalidated third-party packages, according to Anomali citing OWASP analysis of more than 220,000 CVEs. The control problem is no longer isolated code review but trust in the software ecosystem around the application.
NHIMG editorial — based on content published by Anomali: OWASP Top Ten updates, AI voice scams, DanaBot malware, Lumma Stealer and related threat coverage
By the numbers:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%).
- AI-related credential leaks surged 81.5% year-over-year in 2025.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone.
Questions worth separating out
Q: What breaks when software supply chain controls are only partially automated?
A: Partial automation creates inconsistent enforcement, which means some builds are protected while others slip through manual exceptions or forgotten paths.
Q: Why do build systems and package registries matter to identity governance?
A: Build systems and package registries rely on service accounts, signing keys and deployment tokens that act with organisational authority.
Q: What do teams get wrong about private repositories and trusted vendors?
A: A private repository is not a guarantee of safety, and a trusted vendor is not a substitute for verification.
Practitioner guidance
- Inventory all software delivery identities List every service account, API key, signing certificate and bot account that can publish, approve or deploy software.
- Restrict build and publish privileges Separate read, build and release permissions so that no single automation identity can both change and ship artifacts.
- Rotate and revoke secrets tied to CI/CD Treat pipeline secrets as short-lived credentials with automated rotation and immediate revocation when compromise is suspected.
What's in the full analysis
Anomali's full post covers the operational detail this post intentionally leaves for the source:
- The specific OWASP 2025 category reshuffle and how it affects prioritisation across application security teams.
- The named supply chain failure modes OWASP used to justify the ranking change, including dependency substitution and tampered build pipelines.
- Anomalies and incident examples that show how ecosystem compromise reaches production through trusted software delivery paths.
- The analyst commentary that ties the OWASP shift to current defender focus areas across software assurance and access control.
👉 Read Anomali's overview of the OWASP Top 10 2025 supply chain shift →
Software supply chain failures in OWASP Top 10 2025: what changes now?
Explore further
02/08/2026 1:18 pm
Software supply chain failure is now an identity problem as much as a code problem. The article is right to move beyond dependency hygiene and toward ecosystem trust, because the actors making software move are credentials, service accounts and signing keys. If those identities are poorly governed, application security becomes downstream theatre. Practitioners should treat pipeline identities as first-class assets, not invisible plumbing.
A few things that frame the scale:
- Internal repositories are 6x more likely to contain secrets than public ones (32.2% vs 5.6%), according to The State of Secrets Sprawl 2026.
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, according to The State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations respond when package publishing credentials are stolen?
A: Immediately revoke the stolen publishing access, review recent publishes, and rotate every adjacent credential that the compromised identity could reach. Then inspect developer endpoints for persistence, because the attacker may have left backdoors outside the package manager. Response has to cover both registry access and local workstation state.
👉 Read our full editorial: OWASP Top 10 shifts put software supply chain failures in focus
