Top Notch Policy Implementation for Impregnable Security
About UsConferencePartner With Us
CIOREVIEW >> Security >> NEWS

Our vision: Securing the entire software supply chain

CIO Review

The use of open-source software has quickly exposed all parts of the software development process as part of the overall attack surface, and has even lead to the creation of new attack types.

Organizations must take steps at every stage of the software supply chain to ensure developers’ environments. Enterprises must also make sure processes and secured, so you aren’t leaving your business vulnerable to next-generation SCS attacks, like AI package hallucinations, dependency confusion, typosquatting, and repojacking.

Let’s dive into a brief history of how “supply chain security” has evolved to the point we are today, what organizations must consider when securing their software supply chain, and how Checkmarx is proactively building new solutions to address this complex and ongoing issue.

Our mission to secure the entire software supply chain

For the past 10 years, security professionals have been trained that before you release code, all high vulnerabilities need to be identified and fixed. But over the last few years especially, the world has changed. According to GitHub, open source is now the foundation of more than 90% of the world’s software. Organizations are now facing a shifting attack landscape, along with an overwhelming number of vulnerabilities. The attack landscape is moving from the application itself, to where there are new vulnerabilities and weaknesses – in the process surrounding your development, and the components you use to build your application.

What software supply chain security really means

Traditionally, supply chain security was to a way to gain visibility and mitigate 3rd-party code vulnerabilities through SCA. But as time went on and as new attack types emerged. In a 2021 executive order, software bill of materials, or SBOMs, are required for all software sold to the US federal government. The mandate underscores the importance of an accurate list of all open-source software ingredients found in a software-based product. The market quickly realized that the scope of software supply chain attacks, and how we prevent these attacks, go way beyond SBOMs and malicious packages.

Supply chain security is defined as a specific aspect of application security that focuses on protecting the software development process and the components used in that process. Software supply chain security is not a single solution; it is a discipline.

Supporting the SLSA Framework

The Supply-chain Levels for Software Artifacts (SLSA) framework, developed in collaboration with the OpenSSF and Google, addresses the growing concern of software supply chain security, offering a structured approach to assessing and improving the integrity of software components used in development.

SLSA introduces key concepts like artifacts, provenance, digests, immutable references, and build integrity, that provide a systematic way for the software industry to secure the development lifecycle and promote consistent security standards.

Understanding that the full scope of SCS is beyond a single tool, Checkmarx has implemented a broader strategy to cover things outside of your typical application security posture management, in full alignment with the SLSA framework.

How Checkmarx is helping you secure your software supply chain

Today, Checkmarx is providing expert guidance and proven solutions to manage open-source risk, along with new and exciting solutions to start protecting your entire supply chain today.

In the last few years, one of the biggest emerging threats have been malicious packages – notably different from vulnerable packages. In the SLSA framework, malicious packages are a form of dependency attack where attackers inject or contribute malicious code into open-source projects that your developers download and build into your applications. Once downloaded, the attacker's malicious code is running within your applications, with whatever unknown intent the package carries.

Checkmarx SCA, introduced in 2021, was a major step in helping organizations identify and start reporting on their open-source vulnerabilities. We were the first vendor to include malicious package detection inside our SCA solution. Since then, our research team has inspected over 7.6 million open-source packages for all kinds of threats, finding 200,000+ malicious packages. We make that threat intelligence available to you, either in our SCA product, where findings are in the portal or directly in developers’ IDE, or through an API-based threat intelligence feed.

Checkmarx SCA enables automated SBOM generation, and Checkmarx Container Security, which works with Checkmarx SCA, identifies vulnerabilities in open-source packages included in container images. Together with our partners at Sysdig, we recently announced runtime insights, so organizations can get the full picture of pre-production and deployment, gaining visibility into which container images are in-use and prioritize the ones that pose the most risk.

We realized customers need support in prioritization, especially with all these newly discovered vulnerabilities, so we released Exploitable Path. It’s a unique feature that allows our customers to prioritize vulnerabilities in open-source libraries.

When you look at the SLSA framework, we also have always led the way in terms of identifying Infrastructure-as-Code (IaC) misconfigurations. We are the driving force behind the most downloaded open-source tool in this area – Keep Infrastructure as Code Secure, or KICS for short.

All of these are important tools in managing open-source risk, but we are not stopping there.

Since GenAI is becoming a popular resource for developers to generate code, a variety of new SCS attacks have recently emerged, such as:

• AI hallucinations: These are false data points or patterns that AI models might "perceive" due to adversarial inputs or misinterpretations, which can be exploited by malicious actors.

• Prompt injections: Threat actors can manipulate AI models by introducing or “injecting” specially crafted prompts, tricking the system into undesired behaviors or outputs.

• AI secret leakage: There's a potential risk of AI models inadvertently revealing confidential information they were trained on, offering a goldmine for cybercriminals.

In August, Checkmarx introduced the industry’s first plugin to detect and prevent attacks against ChatGPT-generated code. The plugin enables developers to easily scan their ChatGPT-generated code for vulnerabilities within the ChatGPT interface, receive instant feedback on potential vulnerabilities or validation of open-source packages, and employ protection against malicious open-source packages.

Now, we’re leading the way again, and broaden the definition of software supply chain security, beyond just malicious packages, to every component in, and every tool used to build your applications. As part of the Checkmarx One 3.0 launch, we’re taking it one step further, introducing two new capabilities –Secrets Detection and Project Scorecard.

Prevent secrets from leaking on external tools with Secrets Detection

Secrets, such as passwords, API keys, cryptographic keys, and other confidential data, are a frequent target of a distributed supply-chain attack.

Secrets can easily be mistakenly shared on external tools like slack, confluence, twitch, and documentation pages.

Secret detection isn’t new – we have one of the most popular open-source tools for secret detection. 2MS from Checkmarx has over 2 million downloads, and anyone can get started today by detecting secrets such as login credentials, API keys, SSH keys and more hidden in code, content systems, chat applications and more.

If you are a Checkmarx One user, Secret Detection is now available directly in the Checkmarx One platform.

Tackle the most vulnerable projects first with Project Scorecard

One of the latest additions to the Checkmarx Supply Chain Security portfolio is Project Scorecard, which enables organizations to check their own projects quickly and see the most vulnerable or at-risk projects, allowing enterprises to prioritize which to tackle first.

Project Scorecard leverages the format from a popular tool, the OSSF Scorecard, which assesses open-source projects for security risks through a series of automated checks.

These checks cover different parts of the software supply chain including source code, build, and dependencies, and assigns each check a score of 1-10. An auto-generated “security score” helps users as they decide the trust, risk, and security posture for their specific application.

While an important tool in combating the uptick of open-source software attacks, open-source projects are only a portion of the projects in your application. Checking the process and components of owned projects is an important element in securing the total software supply chain.

With Project Scorecard, users can auto-generate a security score for their own projects based on a series of checks, including:

• Binary Artifacts – Is the project free of checked-in binaries?

o Branch Protection – Does the project use branch protection?

o CI Tests – Does the project run tests in CI, e.g., GitHub Actions, Prow?

o Code review – Does the project practice code review before code is merged?

o Dangerous workflow – Does the project avoid dangerous coding patterns?

o Vulnerabilities – Does the project have unfixed vulnerabilities?

By utilizing the Project Scorecard, as part of the Checkmarx Supply Chain module, we allow enterprises to quickly see the most vulnerable or at-risk projects, and ultimately help prioritize which to tackle first.

Taking the next step to secure your software supply chain

It’s important to take steps to secure your software supply chain today; detecting supply chain attacks in code packages, securing your developer’s evolving workstations supports rapid development while reducing risk.

Current Checkmarx One or Checkmarx SCA customers will have access to all these tools within the platform.

If you’re not already a Checkmarx One customer, you can start securing your software supply chain today with too many secrets (2MS), available as an open-source project on GitHub.

We’re incredibly excited to announce these new features to help you secure your software supply chain, but we’re only getting started. The work of securing the software supply chain is never done, as bad actors identify innovative new ways to capitalize on gaps in process and components, so stay tuned for more exciting announcements.

If you’d like to learn more register now to join us for our technical deep dive webinar on Nov 6th, “Secure your software supply chain”.

More in News

A software engineering and AI analytics purchase can fail long before model accuracy becomes a concern. The bigger challenge is often the handoff between existing infrastructure and new analytics, especially when camera networks and edge devices were never designed to share context. Replacing everything may simplify architecture on paper, but it can strain capital requirements and stretch deployment timelines. Buyers need to know whether a platform can work across existing technology boundaries without turning modernization into a wholesale infrastructure project.  Integration depth is therefore more revealing than the number of AI features on a product sheet. A useful platform should accept heterogeneous inputs and expose their data through a common control layer without forcing every piece of existing hardware to conform to one technical standard. It should also preserve the usefulness of legacy assets while making their information accessible to newer analytics. That matters in distributed environments where hardware replacement may be slow or economically unjustified. The real question is whether modernization can proceed around installed infrastructure rather than requiring a clean slate.  Real-time analytics creates an attention problem of its own. Video feeds and sensor events can overwhelm staff when every detection is treated as equally important. Buyers should examine how a platform separates routine activity from events that merit human review, and then look at how quickly those events reach the people responsible for validation. The difference between raw monitoring and useful analytics lies in this filtering step. A system that produces more alerts without improving prioritization merely transfers workload from observation to triage.  Architecture becomes more consequential as data volumes rise. Sending every high-definition stream to a centralized cloud environment can create avoidable bandwidth costs and response delays. Edge processing can reduce that burden when analytics are performed close to the source and only selected information moves upstream. Yet edge deployment introduces management demands. Devices and application services still need a coherent way to exchange information and support later investigation. Buyers should also examine how much infrastructure complexity is added when analytics move closer to the source.  “ CFBD ’s hybrid architecture connects legacy environments to newer computing infrastructure through hyperconvergence and virtualization.” Searchability deserves equal importance. Once video or sensor data has been transformed into structured metadata, teams should be able to move from live detection to later investigation without manually reviewing hours of footage. Useful systems retain descriptive attributes and behavioral context in forms that can be queried quickly. The buying question is whether that context survives across live monitoring and retrospective analysis rather than being trapped in separate workflows. Fast retrieval matters because delayed investigation can erase much of the advantage gained from real-time detection.  CFBD merits consideration for buyers facing this mix of integration pressure and analytics workload. Its AZOR Ecosystem, a real-time data orchestration platform, centralizes video and sensor information. AZOR Panel, a centralized monitoring interface, receives AI-filtered events for human validation. AZOR Analytics, a video analytics component, supports real-time and forensic analysis, while edge gateways can process video near the source and pass lighter event data upstream. Its hybrid architecture connects legacy environments to newer computing infrastructure through hyperconvergence and virtualization. The fit is strongest where replacement costs and operator overload are material constraints. For organizations that need AI analytics without discarding usable infrastructure, CFBD is a practical choice.  ...Read more
Customer outreach is moving faster than many compliance programs were designed to govern. A campaign assembled in hours can pass through several applications before a call, text, email or prerecorded message reaches a customer, while autonomous agents compress that cycle further. The exposure is no longer limited to whether a record appeared on a suppression list. Consent status, channel permissions, time-of-day rules and state or federal restrictions can change the answer at the moment of contact. A platform that checks too late leaves legal teams reconstructing decisions after the communication has already occurred. Static controls also create a quieter commercial problem. Large enterprises often carry separate customer records across business units, and a broad opt-out can be applied far beyond the product or channel the customer intended. Conservative suppression may reduce legal exposure, yet it can also remove legitimate audiences from campaigns and weaken the return on CRM or marketing technology investments. Effective governance needs enough context to distinguish a prohibited contact from an allowable one without forcing every business unit to maintain its own interpretation of the rules. The harder test is whether those distinctions survive as consent records move between systems and outreach programs change. “Gryphon’s deterministic rules-based decisioning evaluates contact permissions in real time, while automated evidence capture gives legal and compliance teams a defensible record of why each decision was made.” Speed matters at the decision point, not merely during campaign preparation. List scrubbing and periodic audits remain useful for certain tasks, but neither is designed to govern communications that originate across contact centers, individual employees, enterprise applications and autonomous agents. Decisioning should sit inside the existing workflow and evaluate the applicable permissions before outreach proceeds. The answer also needs to return quickly enough that compliance does not become a queue. Enterprise scale is equally important. A control layer that works only for one channel or one application recreates the same fragmentation it was purchased to remove. Policy changes also need to propagate without campaign teams waiting for separate rule updates in each downstream application, especially when restrictions take effect quickly. Defensibility separates governance from simple blocking. Executives should expect a clear record of the rule applied, the evidence used, the policy version and the reason a communication was allowed or stopped. Those records need to remain searchable as regulations and internal policies change. Deterministic decisioning has particular value where an organization must later explain exactly why a contact was permitted. The same discipline helps compliance teams identify oversuppression rather than treating every uncertain record as unusable. Buyers should also examine how readily the platform connects to existing CRM, contact-center, marketing automation and governance systems, since a long replacement project can undermine the speed advantage that real-time controls are meant to provide. Gryphon  is the premier choice for enterprises that need contact governance embedded directly into customer engagement rather than added as a later review. Its platform applies real-time controls across voice, SMS, email and interactions generated by AI agents while integrating with existing enterprise applications. Gryphon’s deterministic rules-based decisioning evaluates contact permissions in real time, while automated evidence capture gives legal and compliance teams a defensible record of why each decision was made. Compliance Hub extends that visibility into audit research and reporting. The platform also identifies contacts suppressed too broadly, helping organizations preserve legitimate reach without relaxing policy enforcement. For buyers balancing regulatory exposure against legitimate customer contact, point-of-contact enforcement paired with documented decision logic makes Gryphon a practical recommendation. ...Read more
Disconnected data work rarely begins at the pipeline itself. The delay often appears earlier, when a proposed data product moves from a business idea into requirements, architecture decisions, access controls and a development environment. Each handoff can introduce another tool or approval path, while product context becomes harder to preserve. By the time engineering begins, teams may already be reconciling mismatched project names, duplicated documentation, fragmented ownership and inconsistent setup across systems. Portfolio-level visibility also matters before engineering starts. A platform that preserves business cases alongside product definitions can help leadership compare proposed work, assign teams and select technology stacks without separating prioritization from the delivery path that eventually executes those decisions. That fragmentation becomes expensive when orchestration is purchased as another isolated layer. Data teams commonly work across cloud infrastructure, code repositories, ticketing systems and specialist data platforms, while product managers and architects need continuity across the same work. Replacing that estate is rarely the practical objective. A stronger platform coordinates existing environments while preserving product identity and approved technology choices throughout delivery. Integration depth matters less as a feature count than as a way to remove repeated setup and cross-tool reconciliation. “Calibo can establish access to selected technology stacks and generate CI/CD pathways for controlled movement between development and production environments.” Self-service also needs boundaries. Provisioning development environments, granting access, creating repositories and triggering infrastructure changes can remove substantial waiting time, but only when those actions follow established controls. The useful distinction is whether routine requests can execute from approved templates and policies rather than pass through manual service tickets. That changes the role of platform and architecture teams. Instead of completing repetitive setup on demand, they can establish guardrails that engineering teams use independently. Traceability becomes harder once a project leaves experimentation and enters controlled delivery. Changes to requirements can alter pipeline work, while release movement creates dependencies across development, test, staging and production. Executives need a clear line from the original business case to the technical work that follows, particularly when multiple data products compete for budget or shared engineering capacity. Visibility into status, resource use, dependencies and release progress helps management identify where work is waiting without rebuilding the picture from separate tools. It can also expose queueing between teams before delayed approvals become late-stage release problems. Release control should be treated as part of orchestration rather than an adjacent DevOps concern. Creating a pipeline is only part of the purchase decision. The harder question is whether code and data products can move through governed environments without custom coordination each time. Automated CI/CD setup, reusable templates, policy-based promotion and dependency visibility can make that movement repeatable. This becomes more important for AI-related data work, where experiments can appear quickly but production use depends on controlled access, governed data movement, documented lineage and consistent release practices. Calibo merits recommendation for enterprises that want data orchestration tied directly to the broader delivery lifecycle. Its Data Fabric Studio supports reusable data pipelines. The wider platform carries product context into the development toolchain while automating environment setup. Calibo can establish access to selected technology stacks and generate CI/CD pathways for controlled movement between development and production environments. Its Release Orchestration capability extends that model into deployment governance and dependency management. This gives data teams a self-service framework that reduces manual handoffs while keeping technical work connected to the product context and enterprise controls that initiated it. ...Read more
As software development becomes more reliant on AI, companies have started to focus more on the process of coding, changing, and attributing. Code attribution systems for AI are becoming common for helping engineering professionals know the source of code, differentiate human contributions from that done by AI, and remain visible in the development environment. Their importance goes beyond that of mere tracking since attribution can affect intellectual property management, security assessments, compliance procedures, and engineering performance. However, the implementation of these platforms poses some problems that organizations need to solve before they can effectively use attribution. How Can Organizations Maintain Accurate Code Attribution? An important issue here is the question of establishing accurate attribution in a complicated process of software development. Nowadays, software development includes many repositories, development environments, libraries, automated systems, and cooperation models. The suggestions generated by the artificial intelligence can be accepted, modified, mixed with the existing code, or completely rewritten by the developer. As a result, it becomes difficult to distinguish what part was done with the help of AI and what was developed independently by humans. Data quality also poses a challenge. Attributing authorship requires the availability of development history, history of code changes, prompts, suggestions, and modification patterns. Poor data quality can lead to erroneous findings, especially where organizations employ different methods for software development or use a different set of tools for development. It is imperative for businesses to come up with data standards for the consistency of findings. Issues related to privacy and intellectual property rights make the scenario even more complicated. The source code may include business logic, proprietary processes, and customer data. Companies that choose to implement the attribution platforms need to pay special attention to the way the development data will be gathered, analyzed, stored, and made available. What Makes AI Attribution Difficult Across Enterprise Development? The other challenge is that of incorporating the attribution process into the current engineering process. Companies typically have heterogeneous technology stacks and development processes. This implies that any attribution solution has to be compatible with the source code repositories, issue tracking platforms, code reviews, security mechanisms and so forth. If not, fragmentation and extra manual processes arise. Interpretation is just as crucial. Metrics related to attribution should not be automatically assumed to reflect developer productivity or the quality of code written. While AI can alter how engineers spend their time, more generated code does not imply a better result. Business context regarding maintainability, reliability, reviews, security, and business needs should also be factored in, along with attribution. Attributing AI code is going to be contingent upon transparency, interoperability, and good governance. Enterprises are going to require established processes for attributing contributions made by AI and also explaining how the information is to be utilized. Software systems capable of creating traceable evidence, easy integration, and clear reporting can enable enterprises to create more trust when it comes to AI-enabled development efforts. Taking a good approach towards these considerations will enable enterprises to get visibility regarding the use of AI in coding without having to risk their intellectual property rights and engineering accountability. ...Read more