A number of excessive profile software program provide chain safety incidents over the previous couple of years have put extra of a highlight on the necessity to have visibility into the software program provide chain. Nonetheless, it appears as if these efforts is probably not resulting in the specified outcomes, as a brand new survey discovered that just one out of 5 organizations imagine they’ve that visibility into each element and dependency of their software program.
The survey, Anchore’s 2024 Software program Provide Chain Safety Report, additionally discovered that lower than half of respondents are following provide chain finest practices like creating software program bill-of-materials (SBOMs) for the software program they develop (49% of respondents) or for open supply initiatives they use (45%) of respondents. Moreover, solely 41% of respondents request SBOMs from the third-party distributors they use. Regardless of these low numbers, it is a vital enchancment from 2022’s survey, when lower than a 3rd of respondents have been following these practices.
The report discovered that 78% of respondents are planning on rising their use of SBOMs within the subsequent 18 months, and 32% of them plan to considerably improve use.
“The SBOM is now a essential element of software program provide chain safety. An SBOM supplies visibility into software program substances and is a basis for understanding software program vulnerabilities and dangers,” Anchore wrote within the report.
The report additionally discovered that at the moment 76% of respondents are prioritizing software program provide chain safety.
Many firms are having to make this a precedence as a part of their efforts to adjust to rules. In accordance with the report, organizations at the moment are having to adjust to a median of 4.9 rules and requirements, placing extra strain on them to get safety proper.
Of the businesses surveyed, greater than half have a cross-functional (51%) or totally devoted workforce (8%) that works on provide chain safety.
Lastly, 77% of respondents are frightened about how embedded AI libraries will influence their software program provide chain safety.
For the survey, Anchore interviewed 106 leaders and practitioners which can be concerned in software program provide chain safety at their firm.
