RL SSCS Report 2026: A guidance timeline

This report provides a 2025 timeline of major software supply chain security developments, noting a 73% increase in open-source malware detections and more exposed development secrets, and detailing responses from FDA, CISA, NIST, DoD, EU/ENISA, OWASP, OpenSSF, CNCF, GitHub, the U.K. NCSC, and the U.S. Congress. Key themes include new guidance and regulation, EO updates, alternative vulnerability databases, SBOM minimum elements, strengthened patch/update and CI/CD controls, and GenAI-focused incident response, reflecting a shift toward secure-by-default practices, transparency, and resilient software delivery pipelines.