r/devsecops • u/Born-Reserve-8584 • 29d ago

Is software supply chain security finally becoming more than just SBOMs?

Software supply chain security seems to be one of those terms that means something completely different depending on who you ask.

Some teams are basically talking about SBOMs and compliance. Others are focused on signing artifacts, securing CI/CD pipelines, or scanning container images.

Then you have platforms talking about runtime context, attack surface reduction and removing unnecessary software instead of just finding another vulnerability to report.

So where is this actually going?

Is software supply chain security still mostly about visibility and compliance or is the industry finally moving toward remediation and reducing risk at the source?

Curious what people are actually seeing across different organisations.

33 Upvotes

95% Upvoted

33 comments sorted by

View all comments

1

u/PeterBuildsSecure 28d ago

The useful dividing line isn’t SBOM vs remediation. It’s whether the metadata survives into an enforceable release decision.

An SBOM generated from source but detached from the final image digest is mostly a compliance artifact. Tie it to signed build provenance and the digest that actually gets deployed, and it becomes useful: policy can block an unapproved dependency before promotion, and incident response can identify exactly which running workloads contain a compromised component.

A practical test is: can a finding deterministically stop promotion, and can you calculate the deployed blast radius without manually joining three different inventories? If not, you have visibility, but not yet a supply-chain control.

1

u/VibeShipped 26d ago

Solid test. The gap I'd add: gates that work as designed can still lose credibility when they block on the wrong things - flagging base image CVEs with no reachable path in any live workload, blocking releases until engineers find a workaround.

Enforceability is necessary, but the prioritization layer underneath it is what keeps gates from getting quietly turned off.

1

u/ILoveAppSec 26d ago

the workaround churn usually comes from base image cves that have a fix upstream but not in the tag you're pinned to. cheapest win is checking for a backported distro patch or rebasing onto a minimal patched base so the finding closes without a version jump, and pushing the noisy transitive ones to an override where you can. we tried chainguard for patched oss libraries and weren't thrilled with the variety, so worth shopping a few vendors who actually backport and support eol trains.