Loading story…
MITRE’s prototype Supply Chain Security System of Trust (SoT) Framework provides an evidence-based, customizable method for evaluating supply-chain risk throughout technology acquisition lifecycles. It covers 14 top-level trust-risk areas, roughly 200 sub-areas, and approximately 2,200 assessment questions, emphasizing supplier due diligence and an organization’s security posture.
The framework complements federal software-supply-chain objectives established under Executive Order 14028 and recognizes software bills of materials (SBOMs) as a key inventory and vulnerability-management control. SBOMs can help organizations identify exposure to disclosed component flaws such as Log4j, but they do not by themselves detect covert supplier compromises such as SolarWinds, remediate unpatched issues such as Follina, or create immediate breach-notification obligations; organizations need broader supplier-assurance and incident-response controls.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Robert Martin, a Senior Principal Engineer at MITRE, discussed software supply-chain risk management at the CAPEC Program User Summit.
Executive Order 14208 requires software vendors to provide an SBOM directly or publish one on a public website.
The National Telecommunications and Information Administration published "The Minimum Elements for a Software Bill of Materials (SBOM)," covering component data, automation support, and SBOM generation and use practices.
MITRE developed a prototype Supply Chain Security System of Trust framework to support scalable, evidence-based, customizable assessment of physical and digital supply-chain risks across acquisition lifecycles.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new open-source Software Factory Security Framework (SF²), developed by Julie Davila of GitLab, has been introduced to help organizations strategically scale their security operations. The framework emphasizes resource allocation over simply increasing staff and outlines five core security responsibilities for software-producing organizations: supply chain security, process stewardship, runtime protection, third-party risk management, and continuous learning. SF² provides actionable guidance for each area, such as dependency monitoring and pipeline security controls, aiming to improve both security outcomes and business alignment. Simultaneously, the adoption of Software Bill of Materials (SBOMs) remains a contentious issue in the software industry. While SBOMs are recognized as essential for addressing supply chain security, their practical implementation is hampered by ecosystem complexity and incomplete coverage, especially in open-source projects. Companies like Docker have integrated SBOMs and provenance verification into their container images, but many organizations still struggle to generate comprehensive SBOMs for all software components. Recent updates from CISA have increased requirements for SBOM completeness, highlighting the ongoing challenges and ambivalence within the industry regarding their effectiveness.
Jun 29, 2026
Organizations are moving beyond traditional vulnerability management and treating software transparency as a core security requirement, with **Software Bills of Materials (SBOMs)** becoming central to software supply chain defense. Reporting on preparations for the EU **Cyber Resilience Act (CRA)** says manufacturers of products with digital elements will be required to create, maintain, and when necessary provide inventories of software components, driving broader adoption of SBOM tooling and automation. The shift is intended to improve visibility into open-source libraries and third-party dependencies so teams can identify vulnerable packages, assess supplier risk, and respond faster to newly disclosed flaws. Security practitioners are also pushing companies to use SBOMs as an operational tool rather than a compliance document. Group-IB researcher Anastasia Tikhonova said organizations should apply SBOM data continuously for vulnerability triage, vendor access reviews, identity monitoring, and incident response, as modern supply chain attacks increasingly link phishing, ransomware, and data breaches through inherited trust relationships. She warned that attackers’ use of AI is compressing attack timelines from weeks to minutes, increasing the need to prioritize exposed systems, define compromise windows, contain stolen credentials, and score vendor risk by access level and potential blast radius.
Jul 10, 2026
Recent high-profile incidents such as the SolarWinds, MOVEit, and Log4Shell breaches have underscored the critical vulnerabilities present in the software supply chain, prompting organizations to prioritize third-party risk management and supply chain security at the executive level. Security leaders now recognize that every external dependency, from open-source libraries to SaaS platforms, represents a potential attack vector, with 69% of organizations reportedly impacted by a supply chain security event in the past year. The MOVEit and SolarWinds attacks, in particular, demonstrated how a single compromised vendor can trigger widespread data breaches and operational disruptions across thousands of downstream organizations. In response to these threats, companies are increasingly adopting third-party risk management tools and modern application security practices to monitor and secure their extended digital ecosystems. Industry reports highlight a gap between awareness and implementation of foundational security controls, with many organizations failing to mandate essential protections despite acknowledging the risks. Regulatory bodies such as CISA have also identified supply chain attacks as one of the most persistent and damaging threats, emphasizing the need for proactive, holistic risk management strategies that extend beyond internal systems to encompass the entire vendor ecosystem.
Jul 12, 2026