Going Beyond Secure by Demand

This commentary highlights the rising impact of software supply chain attacks—citing NotPetya, SolarWinds, and 3CX—and critiques reliance on vendor questionnaires and SBOMs as inadequate for genuine assurance. It contextualizes CISA’s Secure by Design and newer Secure by Demand guidance, urging enterprises to go further by independently validating commercial software for malicious components, vulnerabilities, tampering, and suspicious behaviors, and to adopt mature software supply chain security solutions that deliver actionable risk assessments.