* [Topics](/en/topics "Topics") * What is software supply chain security? What is software supply chain security? ======================================= Published February 3, 2026•*4*-minute read Copy URL Jump to section --------------- OverviewWhy software supply chain security?Security risksDevSecOps and software securityApplication securityMitigating threatsWhy Red Hat? Overview -------- Software supply chain security combines best practices from risk management and cybersecurity to help protect the software supply chain from potential vulnerabilities. The software supply chain is made up of everything and everyone that touches your code in the [software development lifecycle](/en/topics/security/software-development-lifecycle-security) (SDLC), from application development to the [CI/CD](/en/topics/devops/what-is-ci-cd) pipeline and deployment. The supply chain includes networks of information about the software, like the components (e.g. infrastructure, hardware, operating systems (OS), [cloud services](/en/topics/cloud-computing/what-are-cloud-services), etc.), the people who wrote them, and the sources they come from, like registries, GitHub repositories, codebases, or other [open source](/en/topics/open-source/what-is-open-source) projects. It also includes any vulnerabilities that may negatively impact [software security](/en/topics/security) – and that’s where software supply chain security comes in. This video can't play due to privacy settings To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers." [Download the supply chain security e-book](/en/resources/software-supply-chain-security-ebook "A blueprint for supply chain security") Why is software supply chain security critical? ----------------------------------------------- Most software today isn’t written from scratch – it’s typically a combination of software artifacts containing open source software. However, these software artifacts are subject to vulnerabilities, and developers have less control over source code from a third party or any changes made to a software artifact over time. It’s important to note that unpatched software is more susceptible to security issues. Because software is essential to executing daily business operations, supply chain security is a crucial responsibility of every organization and security team. Software company SolarWinds was breached in 2020 when attackers launched malicious code via its Orion IT monitoring and management software, a platform used among large corporations and government agencies. By attacking the supply chain, the hackers infiltrated not only SolarWinds but their customers as well. Log4j is a commonly used but widely exploitable open source software that has left countless users and organizations susceptible to data breaches and attacks. In 2021, the president of the United States highlighted the importance of software supply chains and security with 2 White House executive orders: [supply chains](https://www.whitehouse.gov/briefing-room/presidential- actions/2021/02/24/executive-order-on-americas-supply-chains/) and [cybersecurity](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/). [Prepare your systems to comply with government standards](https://access.redhat.com/articles/2918071?extIdCarryOver=true&percmp=7013a000002pwRCAAY&sc_cid=7013a00000264mRAAQ) Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") What are the security risks to the software supply chain? --------------------------------------------------------- Risk to any component of the software supply chain presents a potential risk to every software artifact relying on that supply chain component. It provides hackers the opportunity to insert [malware](/en/topics/security/what-is-malware), a backdoor, or other malicious code to compromise any components and their associated supply chains. Software supply chain attacks, commonly carried out by profit threat actors and nation state actors, are rising and can have dramatic effects in both our digital and physical worlds. These generally fall into one of four types of risks: * Vulnerabilities: are flaws in software code that could be exploited leading to a breach. Patch and update your software artifacts to minimize this risk * Licensing: is a legal risk that could obligate you to make any resulting software artifacts open source and nullify patent rights. Consult legal experts in this area. * Third party dependencies: are any dependency upon any outside organization as part of the software supply chain and are difficult to know. Analyze all third party code and talk to your suppliers about how they protect you. * Processes and policies: are a problem if you do not have them. Create policies for your developers and processes (or playbooks) for when you need to respond to a vulnerability. Common attack vectors include hijacking updates, undermining code signing, and compromising open source code. [Reduce risk with Linux®](/en/engage/improve-security-compliance-ebook "SOLP: Manage security and compliance risk on open source Linux") DevSecOps and software security ------------------------------- [DevSecOps](/en/topics/devops/what-is-devsecops) is an approach to culture, automation, and software design that integrates security as a shared responsibility throughout the entire IT lifecycle. DevSecOps means thinking about application and infrastructure security from the start. It also means automating some security gates to keep the DevOps workflows from slowing down. Selecting the right tools to continuously integrate security, like agreeing on an integrated development environment (IDE) with security features, can help meet these goals. [Red Hat Advanced Cluster Security for Kubernetes](/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes) integrates security checks into the software supply chain and developer workflows to detect and help remediate high risk security issues. It also automates security in DevOps by providing developers with security context in their exisiting workflows. [Learn more about integrating security guardrails with Red Hat® Advanced Cluster Security for Kubernetes](/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes "Learn more about integrating security guardrails with Red Hat® Advanced Cluster Security for Kubernetes") Software supply chain security v.s. application security -------------------------------------------------------- While the software supply chain is made up of everything and everyone that touches your code, application security protects the code itself from attacks and vulnerabilities. Like software supply chain security, application security should be applied at every step of development. Application security begins in the software development lifecycle and extends throughout the application lifecycle with the goals to prevent unauthorized access to your system and protect proprietary data. Strengthening the integrity of your supply chain can in turn increase application security. Hardening configurations, minimizing attack surfaces, restricting permissions, [signing software](/en/blog/sigstore-open-answer-software-supply-chain-trust-and-security), and distributing builds throughout different parts of your system are all ways to keep attackers from compromising your applications. Mitigating software supply chain threats ---------------------------------------- Software supply chain security is important to your organization, your customers, and any organization that relies upon open source contributions. While no organization wants to be breached, it also does not want to be responsible for another organization encountering a similar event. Implementing protections for your software supply chain is the key. Outlined below are some security best practices that security teams should consider: * Provide least privilege access to resources across the supply chain (e.g. developer tools, source code repositories, and other software systems), enable multi-factor authentication, and use strong passwords. * Conduct regular security training for employees. * Harden the security of all your connected devices and sensitive data. * Know your suppliers and who you do business with, starting with your tier-one suppliers. Conduct risk assessments to evaluate each supplier's cybersecurity posture and public policies on vulnerabilities. * Regularly scan and patch vulnerable systems. Developers should also consider secure coding practices, using lock files, and other security-focused initiatives: * Validate checksums. * Include vendor dependencies into source control. * Publish and consume the Software Bill of Materials (SBOM). * Embrace Supply-chain Levels for Software Artifacts (SLSA), which includes: + The ability to digitally sign your software artifacts to authenticate provenance. + Leveraging automation for your processes and policies. * Scan your software with automated security testing tools such as Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST). [Discover global software supply chain security trends](/en/resources/software-supply-chain-security-report-overview "Maturity of software supply chain security practices") Why Red Hat? ------------ Red Hat understands the need to secure software components and dependencies early in the software development lifecycle and uses DevSecOps practices to automate the integration of security at every stage.  Let Red Hat do the work of understanding the upstream supply chain and provide you with a product that you can rely upon and trust your business with 24/7.  Red Hat and its partners bring expertise, a comprehensive DevSecOps ecosystem, and the ability to help organizations implement software supply chain security throughout the software development lifecycle. [Learn about Red Hat® Advanced Developer Suite](/en/products/advanced-developer-suite) The official Red Hat blog ------------------------- Get the latest information about our ecosystem of customers, partners, and communities. [Keep reading](/en/blog "The official Red Hat blog") Additional security features of Red Hat Advanced Developer Suite ---------------------------------------------------------------- Find out more about additional security features, such as trusted libraries, trusted software factory, and exploitIQ, available in Red Hat Advanced Developer Suite. [Learn more about this product](/en/products/advanced-developer-suite/features-benefits "Additional security features of Red Hat Advanced Developer Suite") Keep reading ------------ ### What is security automation? Security automation uses technology to perform tasks with reduced human assistance to integrate security processes, applications, and infrastructure. [Read the article](/en/topics/automation/what-is-security-automation "article | what is security automation") ### What is SOAR? SOAR refers to 3 key software capabilities that security teams use: case and workflow management, task automation, and a centralized means of accessing, querying, and sharing threat intelligence. [Read the article](/en/topics/security/what-is-soar "article | what is soar") ### What's an insider threat? An insider threat is leaked or misused data that—whether released accidentally or purposefully—could be used in malicious ways or viewed by individuals who shouldn’t have legitimate access. [Read the article](/en/topics/security/what-are-insider-threats "article | What's an insider threat") Security resources ------------------ ### Related content * Blog post [Reducing CVE fatigue with Red Hat Hardened Images and Anchore](/en/blog/reducing-cve-fatigue-red-hat-hardened-images-and-anchore) * Blog post [The path to zero trust: Bridging the gap between AI development and OpSec](/en/blog/golden-path-zero-trust-bridging-gap-between-ai-development-and-opsec) * Blog post [Accelerate innovation and govern integrity with Red Hat Satellite 6.19](/en/blog/accelerate-innovation-and-govern-integrity-red-hat-satellite-619) * Blog post [CVE-2026-31431: How Red Hat Advanced Cluster Security and Red Hat Advanced Cluster Management can help](/en/blog/cve-2026-31431-how-red-hat-advanced-cluster-security-and-red-hat-advanced-cluster-management-can-help) ### Related articles * [What is microsegmentation?](/en/topics/virtualization/microsegmentation) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is patch management?](/en/topics/management/what-patch-management-and-automation) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is access control?](/en/topics/security/what-is-access-control) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is API security?](/en/topics/security/api-security) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) [More about this topic](/en/topics/security "More about this topic")