During spring 2026, the Finnish Transport and Communications Agency's National Cyber Security Centre (NCSC-FI) highlighted software supply chain attacks in its Cyber Weather reports. The phenomenon affects virtually every organization involved in software development. In the most severe cases, the consequences of a supply chain attack can range from operational disruption to jeopardizing business continuity.
reliabilitysoftware development
DevSecOpsSecuritySoftware Development
Supply chain attacks demonstrate that software security no longer depends solely on the security of your own source code. Modern applications are built on open-source libraries, third-party components, cloud services, and development tools. If any one of these elements is compromised, the impact can extend to the final product and its users.
Managing software supply chain risks requires identifying dependencies, monitoring software components, ensuring transparency, and embedding security throughout the entire software development lifecycle. In the DevSecOps approach, security is not a final checkpoint but an integral part of development, quality assurance, and operations. Reliable software is a well-managed system where every component is known, traceable, and can be maintained securely throughout its lifecycle.
For example, the March edition of the Cyber Weather report described several supply chain attacks carried out through software components. The threat actor TeamPCP conducted attacks by compromising open-source software projects, including Trivy, Kicks, and the LibLLM Python package. (Kyberturvallisuuskeskus, Kyber Weather March 2026.)
Supply chain attacks are not a new phenomenon, but their significance continues to grow as software becomes increasingly complex. Today, very few applications are built solely from code written within a single organization. This has fundamentally changed the way software security is viewed. Even if an organization's own source code is high quality and thoroughly tested, security risks can still arise from the software supply chain that surrounds it.
Open-source libraries, third-party components, cloud services, and development tools are all essential parts of modern software development—and therefore also part of software security. This is one of the greatest strengths of modern software engineering: developers no longer need to build everything from scratch but can leverage proven solutions created by the wider software community and other technology providers.
However, this also comes with a downside. As software ecosystems have become more complex, the number of dependencies has grown significantly. Even if a developer adds only a few open-source libraries to a project, those libraries may introduce dozens or even hundreds of transitive dependencies. As a result, software security must be evaluated not only through an organization's own source code but also through every library, component, service, and development tool used throughout the software supply chain. If a single link in that chain is compromised, the impact can extend to the final product and its users.
This raises an important question for every software development organization: How well do we actually know all the components and dependencies our software is built on? The question has become increasingly important as software supply chain attacks continue to grow and threat actors look for ways to compromise as many targets as possible through a single attack.
According to Veijo Kingelin, DevOps Specialist at Wirokit, dependency management is an integral part of both software development and day-to-day DevOps operations.
"The libraries and plugins used in software development are primarily the responsibility of the development team, but DevOps must also take into account the uncertainties they introduce. We closely monitor security advisories and version requirements for known extensions and applications. In addition, open-source licensing requirements are addressed during software development, while DevOps teams audit them further—for example, when open-source software is included at the operating system level as part of a delivery," Kingelin explains.
The effectiveness of software supply chain attacks lies in their broad reach. Instead of targeting a single organization directly, attackers compromise a software component, service, or supplier that is used by many organizations as part of their operations. A single successful attack can therefore provide a pathway to dozens, hundreds, or even thousands of victims.
For example, the National Cyber Security Centre Finland described a case in its May 2026 Cyber Weather report in which a supply chain attack targeting an international company was used to distribute malware to organizations relying on the company's products and services. (Kyberturvallisuuskeskus, Kyber Weather May 2026.) This case clearly illustrates how software supply chain attacks work: rather than attacking each customer organization individually, the attackers compromised a single supplier, allowing the impact to spread widely.
This is precisely what makes software supply chain attacks so attractive to threat actors. Modern software development relies heavily on shared open-source libraries, development tools, cloud services, and other common components. When one widely used link in the software supply chain is compromised, the consequences can extend far beyond the original target, affecting countless downstream organizations.
The growing number of software supply chain risks has also changed the way software is developed. In the past, security was often treated as a separate phase toward the end of the development process. The DevSecOps approach, however, integrates security throughout the entire software development lifecycle-from design and development to deployment and maintenance. The goal is to identify risks as early as possible and automate security checks as part of the development pipeline, rather than fixing security issues only after release.
In a DevSecOps environment, software security is not solely the responsibility of cybersecurity specialists. Instead, it is a shared responsibility across the entire development team. Developers, quality assurance professionals, and operations teams work together to ensure security throughout the software lifecycle.
According to Veijo Kingelin, DevSecOps is also reflected in the way organizations manage access rights in practice.
"We are becoming increasingly strict about access token permissions and limiting access wherever possible. The days of using 'full-access' tokens by default are largely behind us. Instead, we carefully determine exactly which permissions are actually needed. Token rotation intervals are typically shorter as well, and we follow the principle of least privilege-granting only the minimum level of access required to accomplish the task. Even developers rarely have unrestricted access to every system using a single credential," Kingelin explains.
In practice, DevSecOps also includes automated dependency checks, vulnerability scanning, and continuous monitoring as part of the software development and CI/CD pipeline. These practices help organizations identify and mitigate software supply chain risks before they reach production environments.
Software supply chain attacks cannot be completely prevented, but their impact can be significantly reduced through systematic dependency management. The first step is understanding what your software is actually built on. If an organization does not know which libraries, components, services, and transitive dependencies its software relies on, it is impossible to manage the risks they introduce.
Managing software supply chain risks does not end when the software is released. Software components are continuously maintained, new vulnerabilities are discovered, and dependency lifecycles evolve over time. According to Sonatype's 2026 State of the Software Supply Chain Report, as many as 65% of open-source CVEs published in 2025 were released without an official severity rating. This highlights the responsibility of organizations to actively monitor the components they use and continuously assess their security. For this reason, it is essential to track the status and security of software components throughout the entire lifecycle of the product-not only during development.
According to Veijo Kingelin, software supply chain risks can also be reduced through development and release pipeline practices.
"Your CI/CD pipeline, risks can be minimized through automated vulnerability scanning, dependency pinning-locking specific versions of software packages-and by separating the final production-ready release from the CI/CD pipeline into a dedicated repository. This prevents newer package versions from being unintentionally introduced during the build process," Kingelin explains.
Achieving complete control over the entire software supply chain is rarely possible. Instead, the key is transparency. Organizations should know which components their software contains, where those components originate, and what dependencies they introduce. The better an organization understands its software ecosystem, the faster it can identify and respond to emerging risks.
From a quality assurance perspective, the software supply chain plays an increasingly important role. Software quality is determined not only by the code developed in-house but also by the components, services, and tools on which the solution depends. Dependencies are therefore an integral part of both software quality and software security.
Software supply chain attacks serve as a reminder that software security and quality can no longer be assessed solely by reviewing an organization's own source code. The better an organization understands the components its software depends on-and the relationships between those dependencies-the better it can respond to emerging threats and ensure the reliability of its products.
Modern software development is no longer about building individual components in isolation. It is about creating and maintaining complex software ecosystems. As a result, software security and quality must be evaluated from the perspective of the entire software supply chain.
Read more: Building Secure Software Is Every Developer's Responsibility.
Ultimately, this is not just about cybersecurity-it is also about software quality. High-quality software is more than well-written code. It is a well-managed system in which every component is known, understood, and can be maintained securely throughout its lifecycle. If software is expected to perform reliably, its supply chain must be managed with the same level of confidence.
Managing software supply chain risks has become an essential part of modern software development. As software is increasingly built on open-source libraries, third-party components, cloud services, and development tools, its security can no longer be assessed solely by reviewing the application's own source code. Dependencies, access controls, software licenses, and build and release pipeline practices all contribute to the trustworthiness of the final product.
The DevSecOps approach integrates security throughout the entire software development lifecycle, from design to operations and maintenance. Automated vulnerability scanning, dependency management, and continuous monitoring help reduce the risk of introducing weak links from the software supply chain into production. Ultimately, this is not just about cybersecurity - it's about software quality. When software must perform reliably, its supply chain must be managed with the same level of care and confidence.
R&D Partner & Expert in Mission-Critical Software & QA
Harder code
