Commercial software risk: New controls required

This piece argues that organizations lack verifiable visibility into commercial, closed-source software and should adopt binary composition analysis to validate or supplement SBOMs and continuously assess third-party risk. Using the Shai-hulud npm worm, a rise in malicious package detections, and the erosion of traditional security boundaries in SaaS as evidence, it highlights the dangers of implicit trust and the limitations of traditional TPRM and questionnaires. It notes growing alignment from major analysts and U.S. government guidance (e.g., CISA) and positions binary analysis as essential across procurement, vendor management, and incident response.