‘The Immutable Laws of Security’ at 25: 5 corollaries for a new era

This article revisits Microsoft’s “10 Immutable Laws of Security” on their 25th anniversary and reframes them for today’s software supply chain reality, highlighting risks such as tampered dependencies, cloud control plane compromise, fragmented and automated admin privileges with leaked secrets, the marginal value of outdated/noisy security tools, and the enduring truth that technology alone is not a cure; it weaves in insights from Ross Haleliuk and Chris Hughes and references findings from the 2025 Software Supply Chain Security Report.