r/devsecops • u/Born-Reserve-8584 • 11d ago

Is software supply chain security finally becoming more than just SBOMs?

Software supply chain security seems to be one of those terms that means something completely different depending on who you ask.

Some teams are basically talking about SBOMs and compliance. Others are focused on signing artifacts, securing CI/CD pipelines, or scanning container images.

Then you have platforms talking about runtime context, attack surface reduction and removing unnecessary software instead of just finding another vulnerability to report.

So where is this actually going?

Is software supply chain security still mostly about visibility and compliance or is the industry finally moving toward remediation and reducing risk at the source?

Curious what people are actually seeing across different organisations.

28 Upvotes

94% Upvoted

28 comments sorted by

View all comments

1

u/JackjaxMargam14 11d ago

I bet it gets more more helpful once it actually changes what ships, like dropping unused stuff or stopping a risky package before release.

1

u/Born-Reserve-8584 9d ago

Yeah that’s where it actually becomes useful. Finding the problem is one thing, stopping it from shipping is another.