Lessons From the Largest Software Supply Chain Incidents

This commentary highlights the rapid rise of software supply chain attacks, referencing recent breaches and research showing steep growth and predictions that many organizations will be affected by 2025. It attributes the trend to complex CI/CD and cloud delivery models, evolving attacker creativity, and GenAI-related risks, and recommends ongoing vendor vetting (including GenAI tools), disciplined open-source usage supported by SBOMs and frameworks like OpenSSF Scorecard, SPDX, and OpenVEX, adoption of SCA solutions, and embedding security controls across the entire software delivery lifecycle to balance innovation with resilience.