Software Supply Chain Attacks: Taxonomy, Frequency, and Detection Approaches

What Did This Cybersecurity Research Find?

This cybersecurity threat landscape survey analyzed 320 documented software supply chain attacks from 2018 to 2024 to create a taxonomy and evaluate detection methods. Cybersecurity supply chain attacks increased 742% over the study period, with dependency confusion and compromised build pipelines as the two most common vectors. Software Bill of Materials (SBOM) analysis detected only 34% of studied attacks at the time of compromise.

Key Findings

• 1Software supply chain attacks increased 742% from 2018 to 2024
• 2Dependency confusion and compromised build pipelines were the top two attack vectors
• 3SBOM analysis alone detected only 34% of supply chain attacks at the time of compromise
• 4Multi-layer defenses (SBOM + build signing + runtime verification) detected 78%
• 5Open-source package registries (npm, PyPI) were the most targeted distribution channels

How Does This Apply to Cybersecurity Careers?

Application security engineers can prioritize supply chain defenses based on the most common attack vectors. Security architects can evaluate SBOM and build pipeline security investments.

Who Should Read This?

Frequently Asked Questions