The Monsters in Your Software Supply Chain That SCA Can't Find

The talk starts from the way software is now built: CI/CD pipelines, microservices and frequent releases have replaced slower waterfall processes, and that shift has widened the set of places an attacker can reach. The speaker argues that supply chain risk is growing for this reason, and that it affects organisations whether they write software or only consume it.

The middle section maps a typical development lifecycle, from developer tools and code repositories through build systems, CI orchestration and open source packages, to deployment. The speaker suggests that the finished build is the most useful point to check for tampering. He explains that common tools such as SAST, SCA, DAST, IAST and RASP are designed to find vulnerabilities, not malware, so they can miss attacks inserted during the build. Recent incidents, including SolarWinds, Codecov, CircleCI and 3CX, are used to show different entry points. Other risks covered include typosquatting, dependency reachability, the Log4j episode, and the need for accurate SBOMs that follow standard formats.

For practitioners, the closing advice is to stop relying on vendor questionnaires and on trust in updates. Teams should compare releases, verify packages, automate checks inside the CI/CD pipeline without slowing developers, and include supply chain vetting in procurement and acquisition due diligence. The talk ends with a homework task for attendees: review vendor security collateral with a critical eye.