FlashFeed

Full text

The global digital economy runs on a thriving ecosystem of third-party vendors, enabling organizations to scale and innovate faster than they possibly could do on their own.

This digital ecosystem is teeming with software suppliers, not just business software that you can buy but also a vast array of software libraries that are embedded in third-party products.

Speed, however, can sometimes be the enemy of risk, as many organizations have not adequately validated whether these third-party technologies are sufficiently safeguarded against cyber threats and other digital risk.

So, while software is a great enabler, it also brings risk, given that it often is built with frameworks and libraries that are not known or well supported.

Consider that companies employ an average of 106 SaaS apps within their IT environments , and the picture becomes quite clear: software supply chain security is a serious concern.

It’s no wonder that half (51%) of participants in the latest Supply Chain Risk Survey ranked software vulnerabilities in supplier products as the most disruptive cybersecurity threat to their organization’s supply chain, behind only data breaches (64%) and malware or ransomware (52%).

An ever-changing attack surface that comprises cloud services , micro-services, APIs, SaaS platforms, third‑party services and now AI agents has expanded well beyond what once was an understood perimeter before widespread digital transformation took hold.

How secure is your own extended digital ecosystem? If this question makes your heart race, then take a closer look at three key considerations for addressing software supply chain security.

1. Visibility: Determine what’s actually in your multi-layered supply chain

Since the software supply chain is part of a vast, interconnected digital ecosystem, organizations likely do not have full visibility of what and who make up their third-party providers. Recent high-profile incidents have signaled just how fragile supply chains can be.

Assuring business continuity requires organizations to scrutinize partners before placing such deep trust in them. That effort starts with knowing who is in your interconnected digital ecosystem before you can start to manage the risk.

Understanding risk across a supply chain is conceptually easy, but it is practically difficult. While clearly outlining security parameters and requirements in supplier contracts is a great starting point, it is not enough, as contracting is generally a point-in-time activity and should be paired with monitoring. You must be able to see and measure software assets so you can better manage them.

After all, you can’t protect what you can’t see, and many businesses still don’t have a complete, accurate asset inventory, meaning that their vulnerability exposure is incomplete. If you don’t know what systems, apps, devices and libraries are in your environment, vulnerability management is supposition, inference and guesswork.

It is crucial to understand what your suppliers are doing both upstream and who you supply downstream, because their decisions are now part of your organization’s own risk profile. Software often presents the biggest blind spots in asset management, thanks in large part to a lack transparency in software build and dependencies, shadow IT, shadow AI and unmanaged endpoints.

An organization's exposure is tied directly to the security posture of every supplier they rely on. Attackers know this, increasingly targeting upstream or downstream partners. You can secure your own environment perfectly and still be vulnerable through others’ oversight. Tools that can profile, quantify and score risk across the supply chain, therefore, are essential, as is tooling that monitors for unusual activity.

2. Vigilance: Prioritize the security of AI integrations across your software supply chain

Threats can lurk anywhere and everywhere across your supply chain. But there’s a new kid in town: AI. The software supply chain has expanded to include the unique risks of AI ecosystem, such as reliance on external foundational models and highly connected agents.

This escalating integration of AI tools makes the multi-faceted software supply chain even more of a concern. Cybersecurity professionals who participated in the latest Cybersecurity Workforce Study revealed a troubling AI-related security event their organization experienced in that prior year: data poisoning (cited by 11%).

Data poisoning happens when bad actors intentionally insert corrupted, misleading or malicious data into the training dataset of a machine-learning model. Even a small amount of poisoned data can change the model’s behavior, in turn resulting in misclassifications, degraded accuracy or malicious outcomes. So suddenly that seemingly helpful ChatBot that is embedded in your CRM , CMS or other purpose-driven enterprise software may not be so friendly after all!

Indeed, organizations simply have little / no control over the software that suppliers are using, making it much more difficult to ensure vulnerabilities are identified before widespread rollout, as well as supported and patched once deployed, but they do have control over scrutinizing suppliers.

Therefore, the people on your security team and the processes they follow matter more than ever. Technology accelerates both sides of the fight, so your real advantage comes from having skilled practitioners who understand how AI changes your risk profile, attack surface and can put the right controls in place to compensate.

Cybersecurity professionals who specialize in software supply chain security can quantify the risk of model poisoning / steering, prompt injection and model inversion, and assess the inherent bias of pre-trained open-source models, protecting the integrity of software and services from upstream vulnerabilities. Such a holistic approach ensures that every component, from third-party libraries to the training data itself, meets the organization’s security and ethical standards.

In addition, reviewing and evaluating vendor agreements is an important task for cybersecurity teams and stakeholders. Think of these disciplined actions as a necessary stress-test meant to identify and address weaknesses and changing needs. A good contract with clear deliverables and expectations is part of a cybersecurity defensive strategy alongside your people and your defense technologies and ongoing monitoring of systems and services.

3. Validation: Adopt skills frameworks and codes of practice for software supply chain security

No organization must stand up against the heightened threat of software supply chain security alone. Take advantage of existing guidance such as the U.K.’s Software Security Code of Practice to follow when you’re trying to batten the software hatches at your own organization.

Not only does this code support software vendors as they adopt secure software lifecycle development practices; it also supports software customers in mitigating the likelihood and impact of software supply chain attacks.

In addition to following code and other guidance frameworks, organizations can look to skills frameworks and vendor-neutral certifications to validate that their cybersecurity professionals demonstrate certain skills needed to build and strengthen supply chain security and resilience.

Skills development in the disciplines of governance, risk and compliance (GRC), secure software development and AI skills better enable cybersecurity and risk professionals to make informed decisions regarding software supply chain security and risk management.

From complexity to better security

Supply chains are complex, longer than you think and multidimensional. Organizations must place much greater focus on stress-testing the resilience of software suppliers and continuously evaluating exposure.

This approach goes well beyond being careful about what software makes it all the way to procurement. The potentially more damaging layer to address in the macro supply chain involves the embedded software and integrated AI tools that other suppliers are using.

The question is not whether your digital supply chain will face disruption. It's whether you have the visibility, vigilance and validation to operate when it does. That’s resilience: the north star of software supply chain security. Without question, transparency has to run through supply chains instead of just sitting inside organizations.

We've rounded up the best endpoint protection software suites .

This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

Full text

QUICK FACTS

Where is it? Over the Bahamas

What's in the photo? The space shuttle Atlantis, preparing to dock with the International Space Station (ISS)

Who took the photo? An unnamed astronaut on board the ISS

When was it taken? July 10, 2011

This stunning astronaut photo shows the last time one of NASA's iconic space shuttles photobombed astronauts' view of Earth as the spacecraft docked with the ISS.

NASA's Space Shuttle Program included five plane-like spacecraft — Columbia, Challenger, Discovery, Atlantis and Endeavour — which collectively completed 135 missions between 1981 and 2011, racking up more than 32,000 hours in space. During that time, they helped to construct the ISS and, later, ferry astronauts to and from the station. The space shuttles also helped to deploy and maintain several other important spacecraft, including the Hubble Space Telescope .

The last space shuttle to fly was Atlantis, which successfully completed 33 missions (the second-highest total, behind Discovery ).

This photo shows Atlantis approaching the ISS for the last time as it passed over the distinctive turquoise waters of the Bahamas . The space shuttle's bay doors are open, exposing its cargo area. This was standard procedure for all space shuttles once they reached low Earth orbit because it prevented the spacecraft's radiators from overheating.

The open doors also enabled the shuttle's docking mechanism, located within its cargo bay, to attach to the ISS, thus creating a pressurized seal so that astronauts could move between the two spacecraft.

Atlantis' final flight began on July 8, 2011, when it launched from the Kennedy Space Center in Florida vertically strapped to a massive fuel tank and a pair of rocket boosters. It returned to Earth on July 21, gliding down to land onto a runway at the launch site. (The spacecraft is now on display at the Kennedy Space Center Visitor Complex.)

In addition to helping construct the ISS, NASA's space shuttles visited Russia's Mir space station, serviced Hubble, and deployed both the Magellan probe to Venus and the Galileo probe to Jupiter. In total, the space shuttle orbited Earth 4,848 times, traveling nearly 126 million miles (203 million kilometers) — more than 525 times the distance between Earth and the moon .

Astronaut photos of the space shuttles were popular because they offered "punctuated snapshots of distinct places on Earth" that were "framed by a human eye," NASA representatives wrote in 2011 . "These images speak to people."

Atlantis touched down at the Kennedy Space Center on July 21, 2011, brining the 30-year Space Shuttle program to an end. (Image credit: NASA/Bill Ingalls) While the Space Shuttle Program achieved a lot during its 30-year history, it famously suffered two tragedies: the 1986 Challenger and 2003 Columbia disasters, which killed all crewmembers on board.

NASA eventually canceled the program in 2011, citing the high cost of maintaining the aging spacecraft and a reduced need for the vehicles after the completion of the ISS the same year. To this day, the space shuttles remain the only winged spacecraft to carry humans into space.

See more Earth from space

'Painting-like' ripples in the Bahamas

A 2020 satellite photo shows off the ethereal beauty of submerged sandbanks and seagrass beds in the Great Bahama Bank.

Glowing ring of algae in New Zealand

A 2026 satellite photo captured a gleaming halo of phytoplankton encircling the remote Chatham Islands and a hidden underwater plateau.

Arctic blast paints plume in Florida

A 2026 satellite photo captured a stunning scene of sediment swirling across the West Florida Shelf after an extreme cold snap.