Solution
Software supply chain security
Software supply chain security checks that the software you build, buy and depend on has not been tampered with and does not hide malware, secrets or exploitable flaws. It matters because attackers increasingly compromise a supplier or a package rather than attack you directly.
What you cannot see can hurt you
Modern applications are assembled from open-source libraries, commercial software and AI-generated code. A list of components shows what was meant to be in the build, not what is actually there. Procurement teams also receive software from vendors with little way to verify it.
What good looks like
- Analysis of the compiled build, not only the source and the component list.
- Detection of malware, tampering and hard-coded secrets in packages and containers.
- Release gates in CI/CD.
- A way to assess third-party and vendor software before deployment.
- Central tracking of findings across all tools.
Vendors that deliver this through Evanssion
| Vendor | Role in this solution |
|---|---|
| ReversingLabs | Spectra Assure analyses releases, containers and third-party software for active threats |
| DefectDojo | Tracks supply chain and other findings in one risk-ranked view |
Questions to ask when choosing a solution
- Does it inspect binaries and containers, not just manifests?
- Can we assess software we buy, not only software we build?
- How does it reduce false positives?
- Can it block a release automatically?
Frequently asked questions
What is a software supply chain attack?
It is an attack that compromises software at a supplier, in a library or in a build process, so that the malicious code reaches many customers through a trusted update.
What is an SBOM?
A software bill of materials lists the components in a piece of software. It is useful, but it does not prove the software is free of malware or tampering.
Does this apply to us if we do not develop software?
Yes. Any organisation that runs third-party software depends on its suppliers' build processes. Assessing vendor software is part of the answer.