Research & Insights

Frameworks, analysis, and guidance across TPRM, supply chain risk, and vendor governance.

a promotional graphic telling you that PCI Compliance is no longer an annual exercise and that continuous monitory must be built in

All Teams6 Supply Chain Risk Managers16 Procurement Security Professionals10 TPRM Practitioners8 Third-Party Governance Teams7 Vendor Due Diligence Analysts7 Compliance and Regulatory Affairs Teams5 Enterprise Sourcing and Procurement Leaders4

Topics:All6 Software Supply Chain Security27 Incident Management17 Regulatory Frameworks7 Monitoring & Performance2 Supply Chain Mapping2 Foundational Concepts1 Ratings & Risk Tiering1

6 articles in Procurement Security Professionals · Software Supply Chain Security · Clear filtersSort byNewest·Trending

Should Runtime Analysis Replace Install-Time Scanning?

Software Supply Chain Security

Latest

4 min read

Should Runtime Analysis Replace Install-Time Scanning?

The Problem A malicious npm package called indexed-btree managed to reach 2 million weekly downloads by hiding its loader inside a normal runtime method, evading most supply chain defenses. GitHub s n

For Procurement Security ProfessionalsRead article

Should You Pin Every CI/CD Dependency to a SHA?

Software Supply Chain Security

4 min read

Should You Pin Every CI/CD Dependency to a SHA?

The Question at Hand The FBI s advisory following the TeamPCP supply chain attacks recommends pinning all GitHub Actions workflows to verified commit SHA hashes instead of using floating version tags.

For Procurement Security ProfessionalsRead

Open-Source Dependency Intake: Six Mistakes That Let Risk Through

Software Supply Chain Security

6 min read

Open-Source Dependency Intake: Six Mistakes That Let Risk Through

Your team assesses commercial vendors with questionnaires, contract reviews, and risk scoring . Then someone merges a pull request that pulls in 47 transitive dependencies from crates.io, npm, or PyPI

For Procurement Security ProfessionalsRead

Seven of 10 Exploited Flaws Are Two Decades Old

Software Supply Chain Security

5 min read

Seven of 10 Exploited Flaws Are Two Decades Old

Your vendor security questionnaires ask about patch cycles and incident response plans. But you re missing the foundational question: Does this vendor build software that creates the same vulnerabilit

For Procurement Security ProfessionalsRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

Key-Based Signing Failed at Scale: What Sigstore's Architecture Reveals

Software Supply Chain Security

4 min read

Key-Based Signing Failed at Scale: What Sigstore's Architecture Reveals

The Challenge Software artifact signing has long relied on the flawed assumption that teams can securely handle cryptographic keypairs across numerous release pipelines without failures. This traditio

For Procurement Security ProfessionalsRead

8 Execution Points Between `pip install` and Production

Software Supply Chain Security

4 min read

8 Execution Points Between `pip install` and Production

When your team runs pip install , you re not just downloading a library. You re allowing arbitrary code to execute on your infrastructure, often with the same privileges as your build pipeline or prod

For Procurement Security ProfessionalsRead

Research &amp; Insights

Should Runtime Analysis Replace Install-Time Scanning?

Should You Pin Every CI/CD Dependency to a SHA?

Open-Source Dependency Intake: Six Mistakes That Let Risk Through

Seven of 10 Exploited Flaws Are Two Decades Old

Stay Ahead of Threats

Key-Based Signing Failed at Scale: What Sigstore's Architecture Reveals

8 Execution Points Between `pip install` and Production

Research & Insights