Confidence in software supply chain security at odds with actual readiness

New research finds that 32 percent of security professionals think they can deliver zero-vulnerability software despite rising threats and compliance regulations. 68 percent are more realistic, noting they feel uncertain about achieving this near-impossible outcome.

The study from Lineaje, carried out among RSA attendees, also shows that while software bill of material (SBOM) regulations and guidelines continue to increase, organizations vary in their level of adoption.

Over 90 percent of modern codebases are built on open-source dependencies, and 95 percent of software weaknesses are directly attributable to this code. Yet a substantial 34 percent of respondents report difficulty in accurately identifying and tracking open-source components, revealing a critical blind spot. 29 percent of teams still lack the tools and processes needed to analyze SBOMs for vulnerabilities.

The report also shows that 38 percent of respondents say they prioritize the most vulnerable areas within their applications. While this may sound positive at first, this means they are leaving the supposedly less vulnerable areas within the software supply chain open to attack.

A large majority 88 percent of respondents report that AI has the potential to critically or significantly enhance software supply chain security visibility. However, AI also presents risks, data security and privacy (35 percent), and AI code generation and vibe coding risks (26 percent) being foremost.

"RSA's theme this year, 'Many Voices. One Community,' emphasized the importance of shedding light on the challenges facing all security professionals. It is heartening to note that security professionals are more aware of security drivers around AI innovations, open-source risks, and increasing regulations," says Javed Hasan, CEO and co-founder of Lineaje. "However, driving safer digital infrastructure requires more action tied to this awareness. Organizations must leverage holistic solutions that can provide visibility into all code, and fix them at the velocity of digital transformations -- so teams can innovate instead of playing catch-up."

You can get the full report on the Lineaje site and there’s an infographic summary of the findings below.

Image credit: everythingposs/depositphotos.com