Supply chain risk make software stack visibility essential

A webinar recap from the IT GRC Forum emphasizes the growing mandate for SBOMs and third-party software transparency, advocating a “Secure by Demand” approach, binary analysis, and risk-based vulnerability prioritization using KEV, EPSS, and CVSS. Panelists urge starting SBOMs with first-party software, verifying received SBOM accuracy, and aligning with compliance frameworks like PCI-DSS 4.0, while poll results show mixed confidence in risk mitigation and widespread concern over third-party/open-source risk; the discussion also highlights often-overlooked firmware and network appliances in patching and monitoring programs.