Notifications
Clear all
Topic starter
19/08/2026 3:24 pm
TL;DR: Transitive dependencies account for roughly 95% of open-source vulnerabilities, so surface-level scanning covers only a fraction of real software supply chain risk, according to Kusari and Endor Labs research. The governing issue is not missing CVEs, but missing recursive visibility, reachability analysis, and ownership across the full dependency graph.
NHIMG editorial — based on content published by Kusari: transitive dependency vulnerabilities and software supply chain visibility
By the numbers:
- According to research published by Endor Labs, approximately 95% of open-source vulnerabilities reside in transitive dependencies rather than in directly declared packages.
- Only 28% of respondents said they had strong insight into deeper transitive dependency layers.
- 47% of teams spend more than five hours per week responding to and remediating software supply chain security issues.
Questions worth separating out
Q: What breaks when transitive dependency visibility is missing?
A: Teams lose the ability to see most inherited software risk, so scans overstate confidence and understate exposure.
Q: Why do transitive dependencies create more software supply chain risk than direct packages alone?
A: Transitive dependencies hide exposure inside nested libraries that are often missed by top-level package reviews.
Q: How can organisations tell whether their SBOM process is actually working?
A: A working SBOM process can generate an SBOM for every release, sign it automatically, let consumers verify it independently, and retrieve the record quickly during an audit or incident.
Practitioner guidance
- Implement recursive SBOM generation Require every build to generate a complete Software Bill of Materials that includes direct and transitive components across all package managers in use.
- Prioritise with reachability analysis Use code-path analysis to determine whether a vulnerable transitive function is actually invoked before assigning remediation priority.
- Track blast radius, not just severity Combine CVSS with EPSS and KEV signals so remediation focuses on exploitable dependencies with real downstream impact.
What's in the full article
Kusari's full research covers the operational detail this post intentionally leaves for the source:
- A deeper breakdown of how recursive dependency graph mapping works across npm, Maven, PyPI, and NuGet ecosystems
- Survey data on where teams struggle most in transitive dependency visibility and how that varies by dependency layer
- Practical examples of how reachability analysis changes prioritisation for vulnerable packages
- Discussion of how continuous monitoring reduces the gap between disclosure and remediation
👉 Read Kusari's analysis of transitive dependency vulnerability management →
Transitive dependency blind spots: what IAM and DevSecOps teams miss?
Explore further
19/08/2026 4:09 pm
Recursive visibility is now a supply chain control, not a reporting enhancement. The article makes clear that most open-source vulnerability exposure sits below the direct dependency layer, which means surface scans are structurally incomplete. That is a governance failure, not an analytics gap. For practitioners, the implication is that software inventory must be recursive by design, or it will continue to overstate confidence.
A few things that frame the scale:
- According to The 52 NHI breaches Report, 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
- 47% of teams spend more than five hours per week responding to and remediating software supply chain security issues.
A question worth separating out:
Q: Who is accountable when a transitive dependency vulnerability reaches production?
A: Accountability should be shared but explicit: engineering owns the component graph, security defines policy and monitoring thresholds, and product or platform teams approve remediation priority. Frameworks such as the NIST Secure Software Development Framework and EU Cyber Resilience Act expectations make it clear that supply chain knowledge cannot be an afterthought.
👉 Read our full editorial: Transitive dependency risk exposes the software supply chain blind spot
