Software supply chain security risks addressed in new Gartner® report

This article reviews Gartner’s October 2023 guidance on mitigating enterprise software supply chain risks, emphasizing third-party risk management based on secure development attestations (e.g., NIST SSDF), mandatory SBOMs for transparency, and adoption of automated tools to detect malware and tampering across first-, second-, and third-party code; it highlights the limitations of traditional AppSec tools, warns that vendors unwilling to provide SBOMs or secure development attestations pose disqualifying risk, cites incidents such as SolarWinds and 3CX as context, and notes ReversingLabs among vendors supporting automated code and binary analysis.