Fragile by Design: Large-Scale Evidence of Supply Chain Risk
summary
Analysis of ~19,000 firmware and container assets across 380+ organizations finds 88% of artifacts contain vulnerabilities, 467 million total hits (~500k unique), and 2/3 of components are invisible in manifests. Binary unpacking reveals 98.7% of vulnerabilities missing from declared manifests, thousands of expired certs, passwordless accounts and co‑located private keys, and concentrated risk in the Linux kernel. A CLI policy engine is shown to block compromised upstream packages (e.g., 476 Anthropic names → 127k transitive versions → 202M Docker pulls).
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:50Visibility problem in supply chain risk
- 3:54Firmware analysis findings
- 5:36Invisible components in manifests
- 7:46NVD limitations
- 9:31Top 10 components and Linux kernel risk
- 10:33Prioritization challenges
- 12:00Legacy code risks
- 13:23Static linking vulnerabilities
- 14:47Non-CVE risks
- 16:33Beyond EPSS prioritization
- 17:58Inventory problem
- 19:01Trust issues in open source
- 20:03Blast radius risks
- 21:49Case study: Anthropic dependencies
- 23:16Provenance detection
- 24:40Good prioritization
- 26:47Policy engines
- 27:48Summary
- 28:10Q&A
related talks
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
40mPanel Discussion: Open Source Supply Chain Security - Are Containers..
30mBroken Links: Emergence and Future of Software-Supply Chain Compromises
16mUnpacking Open Source Security in Public Repos
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
41mThe Divine and Felonious Nature of Cyber Security
28mCode, Dependencies and Security: Where Is the Risk