What’s in your commercial software?

The article summarizes a podcast discussion highlighting growing software supply chain risks in commercial, closed-source software, noting a significant rise in breaches linked to third-party development per the DBIR, and arguing that traditional controls like vendor questionnaires and SBOMs lack sufficient context to detect issues such as malware, tampering, and secrets exposure. It urges CISOs to adopt comprehensive, code-agnostic risk assessments that analyze delivered binaries and cites ReversingLabs Spectra Assure as a solution to generate machine-readable SBOMs and SAFE reports without source code.