Software supply chain security is under heavy pressure. Supply chain incidents more than doubled in 2025, with global losses reaching $60 billion according to industry analysis. Also, Black Duck’s 2026 Open Source Security Report found mean vulnerabilities per codebase climbing from 280 to 581 in one year. Over 70% of organizations also reported at least one third-party or supply chain security incident. Also, nearly every audited codebase contains open-source components. Meanwhile, the EU Cyber Resilience Act’s vulnerability reporting obligations apply from September 2026, with its full requirements, including SBOMs, following in December 2027. Bringing SBOMs and DevSecOps together is now the minimum security posture for anyone shipping software.
Why Software Supply Chain Security Is Under Pressure
The software supply chain is a target because compromising one vendor or open-source package can reach thousands of downstream organizations at once. Suppliers often have weaker controls than the enterprises they serve. Also, stolen vendor credentials give attackers direct access to customer environments, bypassing perimeter defenses. Malicious packages, dependency confusion and typosquatting are also now common across npm, PyPI and other package ecosystems.
Third parties were involved in 30% of breaches in Verizon’s 2025 Data Breach Investigations Report, double the year before. Large campaigns in the npm ecosystem have shown coordinated efforts to evade static inspection and deliver malicious payloads during installation. Also, one self-propagating campaign compromised hundreds of packages and exposed many credentials before it was contained. As a result, dependency management has moved from a technical concern to a board-level security priority.
AI-generated malicious code is also widening the attack surface, since attackers use AI to create more sophisticated packages that are harder to detect. Defenders, meanwhile, are slowed by procurement, legal reviews and legacy integration, so the speed gap favors attackers. Organizations therefore need systems that are resilient by design instead of relying on manual heroics that cannot keep up with automated threats.
In 2026, an AI model is just another third-party dependency, but one traditional scanners cannot read. Pickle injection can allow remote code execution when certain model formats are loaded. Also, the provenance of model weights is unclear for most deployments. Just as code needs SBOMs, AI models now need ML-BOMs that document training data, architecture decisions and safety benchmarks, which extends software supply chain security into the AI layer.
Why SBOM and DevSecOps Must Converge
SBOM and DevSecOps have to converge because static inventories cannot protect delivery pipelines that push code to production daily or even hourly. The question is no longer whether you have an SBOM but whether you can act on it continuously. Vulnerability volumes are also too large for manual triage. So security enforcement has to be automated and built into every pipeline stage.
How Regulation Shapes Software Supply Chain Security
Regulations are forcing SBOM and DevSecOps together by requiring things neither can deliver alone.
| Regulation | SBOM Requirement | DevSecOps Implication |
|---|---|---|
| US Executive Order 14028 | SBOMs mandatory for federal software | ✓ Automated SBOM generation in CI/CD |
| EU Cyber Resilience Act | SBOMs with top-level dependencies, from December 2027 | ✓ Continuous vulnerability management through product lifecycle |
| EU CRA Reporting | 24-hour early warning for actively exploited vulnerabilities, from September 2026 | ✓ Automated vulnerability scanning and instant querying |
| Gartner Prediction | 60% of critical software builders to require SBOMs | ◐ Predicted for software vendors by 2025 |
The EU Cyber Resilience Act requires vulnerability reporting within strict deadlines and SBOM documentation that stays current across the product lifecycle. Organizations deploying code daily cannot meet those requirements by hand. Also, legal exposure rises along with security risk as enforcement tightens. Industry analysis also found that a seven-day waiting period on new package versions would have prevented eight out of ten major 2025 supply chain attacks. So compliance and operational security are converging, which makes SBOM-DevSecOps integration a business requirement.
Open-source software does not work like commercial software: there is no product manager and no support department. Managing obsolete third-party code is a direct challenge under the EU CRA, because manufacturers must keep providing updates throughout a product’s support period. When a critical open-source dependency is abandoned, organizations have to fork it, replace it or accept unpatched risk that regulators will not tolerate.
Talk to an ExpertBehind on SBOMs or CRA readiness? Review your pipeline security with us.
Building Converged Pipelines
Converged software supply chain security combines SBOM generation, vulnerability scanning and policy enforcement in one DevSecOps pipeline that runs continuously. Security feedback then arrives in the developer’s workspace as specific, actionable guidance instead of a flood of low-priority alerts after code reaches production. The SBOM also works as a live observability layer. So when a new vulnerability is disclosed, teams can find every place the component runs within minutes.
Five Priorities for Engineering Leaders in 2026
Based on the threat landscape, here are five software supply chain security priorities:
- Implement automated SBOM generation on every build: Build SBOM generation into CI/CD pipelines with tools such as Syft or CycloneDX. You then keep a real-time inventory of every dependency across your software fleet.
- Adopt the curation-first dependency model: Scanning after the fact is not enough. So block malicious or vulnerable packages at ingestion, before they reach your build environment. A seven-day waiting period on new package versions also stops most supply chain attacks.
- Deploy policy-as-code in every pipeline: The EU CRA requires an early warning within 24 hours for actively exploited vulnerabilities. So enforce security policies automatically on every commit with tools such as Open Policy Agent. Compliance then becomes continuous instead of periodic.
- Extend supply chain security to AI models: AI models are third-party dependencies that traditional scanners miss. So create ML-BOMs that document training data and model provenance. AI supply chain risk then gets the same governance as code dependencies.
- Prepare for EU Cyber Resilience Act compliance: Reporting obligations apply from September 2026 and the full requirements from December 2027. So build the vulnerability management and SBOM processes the regulation demands now. Early preparation avoids rushed work that creates security gaps.
- 30% of Breaches Involve Third Parties: Verizon — 2025 Data Breach Investigations Report
In Brief
Key Takeaway Software supply chain security faces record pressure: $60B in losses, mean vulnerabilities per codebase up to 581, 70%+ of organizations hit by incidents and third parties involved in 30% of breaches. The EU CRA adds 24-hour reporting from September 2026. SBOM and DevSecOps must converge in unified pipelines, with curation-first dependency management, policy-as-code, ML-BOMs for AI models and waiting periods for new packages.
Looking Ahead: Software Supply Chain Security Beyond 2027
Threats will keep rising as AI-generated malicious code gets more sophisticated, attacks spread faster and regulation expands across jurisdictions. SBOM requirements are likely to spread beyond government suppliers across regulated industries. SBOM, DevSecOps and MLSecOps are also converging into platforms that manage code dependencies, binary artifacts and AI models in one place. The question is shifting from whether something is vulnerable to how quickly the organization can upgrade across its whole dependency tree.
Defenders who build converged security now will respond to future attacks in minutes instead of days or weeks, while organizations that still treat dependency management as an afterthought will face both incidents and regulatory penalties. For engineering leaders, the software supply chain is where convergence pays off most, because threat prevention, incident response and compliance all improve together through unified SBOM-DevSecOps pipelines.
Our SolutionDevOps and CI/CD Pipeline Automation
Frequently Asked Questions
References
- 581 Vulnerabilities, Open-Source Debt, EU CRA, SBOM Mandates: Help Net Security — Open-Source Security Debt Grows Across Commercial Software
- $60B Losses, 70%+ Incidents, 7-Day Prevention, Attack Patterns: Bastion — 2026 Supply Chain Security Report
- Curation-First, MLSecOps, PBOM, Dynamic SBOM, Policy-as-Code: Cloudsmith — The 2026 Guide to Software Supply Chain Security
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.