What it means
Risk can enter through compromised accounts, malicious packages, dependency confusion, vulnerable components, build tampering, unsigned artifacts, or untrusted update channels.
Why it matters
Organizations depend on software they did not write and pipelines they do not fully control, making provenance and verification essential.
Practical focus
- Protect source and build identities
- Inventory and evaluate dependencies
- Generate and verify software bills of materials
- Sign and validate build artifacts and updates
Common mistakes
- Scanning only the final application
- Trusting a package because it is popular
- Allowing build systems to use broad persistent credentials
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: