Checkmarx 2024 Software Supply Chain Security Status

Keypoints

• The typical structure of annual cybersecurity reports includes an introduction to current threats, key findings, detailed analysis of technologies and strategies, and a roadmap for future actions, providing a comprehensive overview of cybersecurity trends and vulnerabilities.
• Major statistics reveal that 100% of surveyed organizations experienced a software supply chain attack, with 18% occurring in the last year and 63% within two years, highlighting the pervasive nature of threats.
• Organizations are increasingly concerned about open source software, with 75% indicating high concern due to its widespread usage (around 56%) in their applications, yet effective management remains a challenge.
• Most companies prioritize SSCS as a top concern—57% focus on it actively, and 85% plan to adopt or are already using SSCS solutions—reflecting heightened awareness and strategic importance.
• Survey data shows a significant gap in the effective use of SBOMs; while about half request them from vendors, over half of those do not utilize them effectively, limiting their potential for vulnerability management.
• The report emphasizes that robust SSCS requires an interdisciplinary, shared responsibility approach across development, security, and operations teams, rather than relying on a single department.
• Recent attacks like those exploiting vulnerabilities in open source packages and malicious injection into repositories underscore the need for proactive tools beyond SBOMs, such as real-time malicious activity detection.
• Organizations should focus on integrating SSCS tools into the entire Software Development Lifecycle, especially the maintenance phase, to enhance vulnerability response and control.
• Building a comprehensive SSCS program involves assessing current tools, consolidating capabilities, and expanding coverage across the SDLC, especially in post-deployment stages, supported by vendor-integrated platforms.
• The regulatory environment is tightening, with directives like EO 14028 and NIS2 increasing the pressure on organizations to adopt effective SSCS practices, positioning them for future compliance and business resilience.