This is an update of our report on Software Supply Chain Security (SSCS) that was published in August 2023. If you would like to look at this report, please click this link
This Leadership Compass takes a different approach to SSCS. Unlike traditional SSCS evaluations that focus exclusively on tools for software developers and DevOps teams, this analysis recognizes that the software supply chain includes two distinct but equally important audiences:
- Software Producers - Organizations that develop, build, and release software, requiring tools for code analysis, build integrity, and artifact signing.
- Software Consumers - Organizations that procure, deploy, and operate third-party software without access to source code, requiring tools for vendor assessment, Software Bill of Materials (SBOM) validation, and ongoing risk monitoring.
Most organizations occupy both roles simultaneously, developing some software while consuming vast quantities of commercial and open-source components from external suppliers. This Leadership Compass evaluates platforms that can serve either or both audiences, from pure development-focused solutions to pure consumption-focused risk management platforms, and solutions that span the entire spectrum.
Inclusion Criteria
Minimum Core Requirements
In this Leadership Compass, we are looking for solutions that demonstrate active capability in at least 60% of the following core areas:
- Source code integrity with provenance tracking and verification
- Build integrity throughout the CI/CD pipeline with attestation and signing
- Vulnerability management of code and deployment artifacts
- Third-party supplier risk measurement and monitoring including automated security posture assessment, continuous scoring, and vendor evaluation workflows
- Dependency graph analysis with full transitive dependency mapping and risk propagation tracking
- SBOM generation and management with export/import capabilities in standard formats (SPDX, CycloneDX)
- Secrets management and credential protection with automated detection, prevention, and historical repository scanning
- Package repository security including typosquatting detection, namespace confusion prevention, and malicious package pattern detection
- Integration with CI/CD tools via APIs/SDKs/CLIs with workflow integration
- Policy-based security controls and governance with configurable rules and automated enforcement
- Continuous monitoring and alerting for supply chain events across the entire pipeline
- Runtime monitoring and behavioral analysis of supply chain components with anomaly detection
- Industry compliance framework support including regulatory alignment (EU Cyber Resilience Act, NIST SSDF, EO 14028)
- Incident response and remediation workflows for supply chain compromises including impact assessment and rollback capabilities
- Code signing and attestation with SLSA framework compliance and cryptographic verification throughout the pipeline
- Developer environment security including compromised credential detection and workstation protection
Essential Foundation Requirements
All solutions evaluated must provide:
- Active vulnerability scanning capabilities across the software supply chain
- Basic third-party dependency tracking and risk assessment
- Integration with at least one major CI/CD platform (e.g., Jenkins, GitLab, GitHub Actions, Azure DevOps)
- SBOM export functionality in standard formats (e.g., SPDX, CycloneDX)
- Evidence of production deployment and verifiable customer references
Market Maturity Threshold
Solutions should demonstrate:
- At least 12 months of active customer deployments in production environments
- Published documentation and integration guides for implementation
- Vendor support and maintenance commitments with defined SLAs
- Clear roadmap for capability expansion and feature development
This framework ensures that evaluated solutions represent mature, deployable platforms capable of addressing real-world SSCS challenges rather than experimental or incomplete offerings.
Exclusion Criteria
The following will not be considered:
- Vendors without active production deployments at customer sites
- Point solutions that only provide vulnerability scanning without pipeline integration
- Traditional SCA tools that lack build integrity and supply chain orchestration capabilities
- Solutions that address only container security or only source code analysis without broader supply chain coverage
- Vendors in stealth mode without verifiable customer references
There are no exclusion criteria based on company size, revenue, or geographic region. We evaluate vendors from start-ups to large enterprises, provided they meet the minimum maturity and capability thresholds outlined above.
