The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense

The report highlights a shift in the attack surface from isolated systems to the interconnected software supply chain, driven by increased use of third-party libraries, open-source software, and AI-generated code. This shift means that vulnerabilities in external components now pose a direct threat to internal applications. As a result, the likelihood of experiencing a supply-chain incident has risen to three-quarters of surveyed organizations.

Addressing this shift requires investing in developer-centric security practices, such as shifting security left, providing training on secure coding, and deploying tools that developers can use directly in their workflows. Nearly half of organizations (45%) admit they lack robust supply-chain security, indicating a gap between awareness and effective implementation. The high priority placed on developer-focused security (98% of orgs, with 32% marking it as top priority) reflects the needed cultural and procedural change.

Current security tooling often falls short; vulnerability remediation and identification remain top concerns for 39% and 36% of organizations, respectively. Only secure container services or libraries of hardened container images were rated as very effective by a majority (51%), while other tool categories did not achieve similar confidence. This suggests that many existing solutions do not adequately protect against the evolving risks posed by AI and third-party code.

For engineers, the practical implication is to integrate security checks into the CI/CD pipeline, maintain accurate software bills of materials (SBOMs), and rely on hardened container images to isolate third-party and AI-derived components. Without these measures, the attack surface introduced by AI-generated and external code will continue to outpace defensive capabilities, leaving organizations vulnerable to supply-chain breaches.