Software supply chain security by the numbers: 30 stats that matter

This report compiles 2023–2024 statistics highlighting escalating software supply chain and application security risks: high prevalence of vulnerable apps and third-party/OSS flaws, significant security debt and tool sprawl, growing malicious packages in OSS repositories, and uneven DevSecOps maturity. It underscores rising cloud/SaaS incidents, limited visibility and SBOM adoption momentum, and emerging AI-related risks from coding assistants and secret leaks—offering takeaways for AppSec teams to prioritize continuous testing, supply chain governance, and improved automation across the SDLC.