The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense

Summary

A research report by Omdia examines escalating software supply chain security risks driven by growing dependencies on third-party code, open-source software, and artificial intelligence. Over three-fourths of surveyed organizations experienced a software supply chain incident in the preceding year, with known vulnerabilities in third-party software representing the most common exploit vector. Surveyed respondents ranked AI technology as their top supply chain concern, alongside broader issues involving vulnerability remediation and code composition identification. While shifting security left is a high priority for 98% of organizations, 45% still lack confidence in the robustness of their supply chain defenses. Although secure container libraries and Software Bills of Materials provide measurable mitigation benefits, many organizations only generate inventories on a case-by-case basis.

Context

Increasing use of third-party dependencies, open-source code, and AI-generated code expands modern attack surfaces, leading to 77% of surveyed organizations experiencing a software supply chain incident in a 12-month period.

Takeaways

• AI technology was ranked as the top software supply chain risk by 40% of organizations, outpacing third-party code at 39% and software dependencies at 38%.
• Secure container services or libraries of hardened container images were rated as very effective by 51% of organizations, making them the only tool category rated very effective by a majority.
• Although Software Bills of Materials (SBOMs) assist with vulnerability mitigation and compliance, only 42% of organizations mandatorily generate an SBOM for all applications, while 55% generate them on a case-by-case basis.

Related reading

• Docker · May 18, 2026

  Coding Agent Horror Stories: The Security Crisis Threatening Developer Infrastructure

  Autonomous AI coding agents increasingly handle developer workflows, but their execution model introduces critical security risks. Operating with the executing user's full permissions, these agents can read ambient secrets, inherit cloud credentials, and run destructive shell commands without human intervention. Documented incidents between October 2024 and February 2026 reveal systemic hazards, including unintentional home directory deletions and increased security vulnerabilities in generated code. To address these vulnerabilities, Docker Sandboxes isolate agent execution within dedicated microVMs, preventing access to the host filesystem and blocking common credential paths by default. Routing changes through Git worktrees and restricting network egress ensures that agent actions remain strictly bounded and reviewable before affecting main branches or production infrastructure.

  Jennifer Kohl

• Stack Overflow · Aug 24, 2026