# The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense

[Docker](https://yomu.fyi/company/docker) · Jin Kim · Aug 4, 2026

**Type:** Explainer

## Summary

A research report by Omdia examines escalating software supply chain security risks driven by growing dependencies on third-party code, open-source software, and artificial intelligence. Over three-fourths of surveyed organizations experienced a software supply chain incident in the preceding year, with known vulnerabilities in third-party software representing the most common exploit vector. Surveyed respondents ranked AI technology as their top supply chain concern, alongside broader issues involving vulnerability remediation and code composition identification. While shifting security left is a high priority for 98% of organizations, 45% still lack confidence in the robustness of their supply chain defenses. Although secure container libraries and Software Bills of Materials provide measurable mitigation benefits, many organizations only generate inventories on a case-by-case basis.

## Context

Increasing use of third-party dependencies, open-source code, and AI-generated code expands modern attack surfaces, leading to 77% of surveyed organizations experiencing a software supply chain incident in a 12-month period.

## Takeaways

- AI technology was ranked as the top software supply chain risk by 40% of organizations, outpacing third-party code at 39% and software dependencies at 38%.
- Secure container services or libraries of hardened container images were rated as very effective by 51% of organizations, making them the only tool category rated very effective by a majority.
- Although Software Bills of Materials (SBOMs) assist with vulnerability mitigation and compliance, only 42% of organizations mandatorily generate an SBOM for all applications, while 55% generate them on a case-by-case basis.

**Tags:** [CI/CD](https://yomu.fyi/topic/ci-cd), [Developer Experience](https://yomu.fyi/topic/developer-experience), [Docker](https://yomu.fyi/topic/docker), [LLMs](https://yomu.fyi/topic/llm), [Open Source](https://yomu.fyi/topic/open-source)

[Read original post](https://www.docker.com/blog/software-supply-chain-security-omdia-2026-report)