GCRI · Cybersecurity and Digital Resilience
Supply chain security
Software is assembled from open-source libraries, commercial components, build tools and update channels, and hardware from components made across many countries. Attackers who compromise a widely used component or update can reach thousands of downstream users at once. This page sets out how supply chain attacks work, how software provenance and composition are made visible, and what evidence serves developers, buyers and regulators.
How the work runs.
Security posture and third parties
Supply chain security · Enterprise network · Quarter 4
CSF profile, current vs target
tier 1 to 4
Critical suppliers
| Supplier A | Cloud hosting | Yes | Medium |
| Supplier B | Payroll SaaS | No | Unknown |
| Supplier C | Managed SOC | Yes | Low |
| Supplier D | Identity provider | No | Unknown |
Critical vulnerabilities open
Fig.Security posture and third parties: example names and illustrative values, not a record or a live system.
Supply chain security: how the risk develops.
Software and hardware dependency risk. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Dependencies run deep
A typical application includes hundreds of open-source packages, each with its own dependencies. A flaw or backdoor deep in the tree reaches every product that uses it.
Build and update channels are targets
Compromising a build system or update server lets attackers distribute malicious code signed and delivered as legitimate updates.
Maintainers are few and stretched
Critical open-source projects are often maintained by small volunteer teams, making them vulnerable to burnout, takeover and social engineering.
Visibility enables response
When a widely used component is found vulnerable, organisations with a software bill of materials can find and fix affected systems quickly; others search blind.
Activity and hazards in Europe.
Night lights, population density and true-colour imagery over Europe, from NASA GIBS. Each layer carries its own date.
The interactive map needs JavaScript; the layer list and sources are below.
Layers 3
Activity and hazards, for this page
Keyboard, with the map focused
Hold Ctrl or ⌘ and scroll to zoom
Latest available
NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth
Loading the latest NASA imagery.
Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.
Activity and hazards, framed on Europe.Satellite and model products as NASA publishes them, each with its own date. They are indicators, not assessments of any place.
Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural Earth · NASA EONET · NASA HLS S30Sources and licences
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
- VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- MODIS land products (vegetation indices, gross primary production, land cover), NASA LP DAAC and LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- GHRSST Level 4 MUR analyses, NASA Jet Propulsion Laboratory; distributed by the NASA Physical Oceanography DAAC (PO.DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
- Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
- © OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). ODbL
- Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into hexagonal cells where shown (modified). NASA open data
- Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
- Live events: NASA Earth Observatory Natural Event Tracker (EONET); events are indicative and keep their original source links.
- Live: NASA EONET Events are indicative, not authority warnings.
- Observed (EO): NASA HLS S30 (contains modified Copernicus Sentinel data 2026). We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
- Weather data by Open-Meteo.com (https://open-meteo.com/), licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
- Optional layers (7 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.
Layers and dates
- Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
- Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
- Flood water, 3-day composite: VIIRS Global Flood Product, NASA LANCE · 14 Oct 2026
- True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026
- Land cover type (IGBP), yearly: MODIS Terra and Aqua land cover (MCD12Q1), NASA LP DAAC · 2024
- Sea surface temperature anomaly: GHRSST MUR25, NASA JPL PO.DAAC · 12 Oct 2026
Software supply chains cross every domain.
- EnergyCouplingGrid software and firmware come from shared suppliers.What to watchBill of materials coverage
- HealthCouplingMedical device software includes third-party components.What to watchComponent vulnerability response
- WaterCouplingUtilities depend on vendor updates for control systems.What to watchUpdate verification
Supply chain findings are designed for the Exponential Technology series. SLSA, SPDX (ISO/IEC 5962:2021), NIST SP 800-161 and the EU Cyber Resilience Act frame practice; software in the programme would carry bills of materials under NS-12 of the proposed Nexus Standards.
- Bill of materials practice reviews.
- Supplier compromise cases.
A shock through an input-output economy.
A loss of output in one sector propagates through the technical coefficients to its suppliers and customers, and recovers at the rate you set; the coefficients are teaching values, not national accounts. Teaching model with stated illustrative values, not a prediction. The map on this page shows Europe; the model itself is not tied to a place.
Controls
- Sector hit first (position in the list)
- 0
- Size of the shock
- 30% of its output
- Duration of the shock
- 30 days
- Recovery rate
- 0.08 per day
- Days simulated
- 180 days
Readouts
- Output lost over the run
- 0.52% of a year's output
- Total over direct (multiplier)
- 1.62 times
- Most affected other sector
- Manufacturing
- Its peak inoperability
- 4.0%
Numbers, methods and sources
| Sector | Peak inoperability (%) | Output weight (%) |
|---|---|---|
| Telecoms and data | 30.33 | 10.1 |
| Finance | 1.04 | 21.2 |
| Retail | 0.32 | 11.6 |
| Logistics | 2.75 | 25.2 |
| Public services | 0.10 | 14.7 |
| Manufacturing | 4.03 | 17.2 |
Methods
- Input-output analysis Leontief (1936); Miller and Blair (2009), Input-Output Analysis, Cambridge University Press
- Inoperability input-output model Haimes and Jiang (2001), Journal of Infrastructure Systems 7
- Dynamic inoperability and recovery Lian and Haimes (2006), Systems Engineering 9
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Seaports Natural Earth
- Maritime chokepoints Nexus (named straits and canals at their published coordinates)
- Railways Natural Earth
- Major roads Natural Earth
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Cybersecurity and Digital Resilience in Foundry
- Tested at Cybersecurity and Digital Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Cybersecurity and Digital Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Products shipped with a software bill of materials | percent of products | per assessment | Vendor disclosures | DECLARED |
| Open-source dependencies with known vulnerabilities | count | weekly | Software composition analysis | OBSERVED |
| Builds with verifiable provenance | percent of builds | monthly | Build attestation records | OBSERVED |
| Malicious packages reported in registries | count | monthly | Package registry and research reports | REPORTED |
| Critical projects with security practices in place | score on a stated checklist | per assessment | Open-source scorecards | ESTIMATED |
| Time to remediate a critical component vulnerability | days | per event | Remediation records | OBSERVED |
Model supply chain security as a system. Run the cascade.
Assembled from the Nexus Standards area profile Supply chain and trade risk: the hazards it names, the systems and sectors that carry the loss, the controls that dampen it and the data that observe it. Choose the components, pick an initiating hazard and step through the cascade. The Map view places the run on an example geography with open data. Every coupling weight is a stated assumption you can change. A teaching model, not a forecast, an assessment or a certification. To model a place of your own choosing, open the full System Builder.
Hazards
- Dam failure
- River flood (set off downstream)
- Flash flood (set off downstream)
- Mass displacement (set off downstream)
- Widespread power outage (set off downstream)
- Water supply shortfall (set off downstream)
Systems and couplings
- Supply chain and trade risk
- Food security and nutrition risk Cascade
- Oceans and coasts risk standards Exposure
- Geopolitical and security risk Common driver
- Cyber and digital risk standards Cascade
Controls
NS-0Constitution and principlesNS-3Risk record UNIs (grammar, legacy crosswalk, allocation authority)NS-9Contextual UNIs (deployments, instances, programme instances)NS-10Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)NS-11Verification and monitoring (evidence, attestations, zero-trust conformance observation)NS-12Software, model and AI/ML artefacts (supply chain, model cards, dataset sheets)NRS-H60Hazard family: Supply-chain and flow disruption (NHS-1 sys.supply-chain)NRS-X4Trade, transport and supply chains riskNRS-H89Hazard family: Transport network disruption (NHS-1 infra.mobility)NRS-K38Domain pack profile: Supply chain trade (DOMAIN-038)NRS-H43Hazard family: Livestock and aquaculture epizootics (NHS-1 health.animal-health)NRS-M10Method fabric: Markets, trade and supply chains
Observation
- IMF PortWatch port activity and chokepoint disruptions (listed for reference)
- Global Supply Chain Pressure Index (listed for reference)
- OECD Data Explorer (SDMX API) (listed for reference)
- World Bank Open Data and World Development Indicators API (listed for reference)
- Developing countries' and least developed countries' share of global exports
- Passenger and freight volumes, by mode of transport
Example geography
- The Strait of Malacca: 227 hexagonal cells
- Night lights tonight, outages (VIIRS Day/Night Band), NASA GIBS
- Surface water through cloud, 30 m (OPERA DSWx-S1 radar), NASA GIBS
- Rain rate, last half hour (IMERG), NASA GIBS
- Surface soil moisture (SMAP), NASA GIBS
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| OpenSSF Scorecard | Automated checks of open-source project security practices | Open source, Apache 2.0 |
| SLSA framework | Levels of supply chain integrity for software builds | Open, community specification |
| CycloneDX and SPDX specifications | Standard formats for software bills of materials | Open standards (SPDX is ISO/IEC 5962) |
| OSV open source vulnerability database | Vulnerabilities mapped to open-source package versions | Open, CC BY 4.0 |
| EU Cyber Resilience Act and NIST Secure Software Development Framework | Requirements and practices for secure products | Public, EU and US government terms |
How supply chain security is modelled, measured and tested.
The model, its assumptions, its data and its uncertainty, in the form a scientist or engineer would check. Structures follow published methods. The values drawn are illustrative, not findings.
System model
The couplings between the systems in supply chain security: signs of influence, a reinforcing and a balancing loop, and cross-links where stress jumps.
Who decides, and what the evidence serves.
Cybersecurity and Digital Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Software developers and vendors | Which components to trust and how to secure builds | Dependency analyses; provenance assessments |
| Buyers and procurement authorities | What supply chain evidence to require | SBOM reviews; security terms |
| Regulators | How to apply product security requirements | Adoption and vulnerability evidence |
Outputs this topic produces
- Dependency network analyses of critical software
- SBOM adoption and quality reviews
- Build provenance assessments
- Evidence notes for procurement security terms
What experts ask.
Compromising one widely used component can give access to thousands of downstream organisations, which makes supply chains attractive to capable attackers. Accidental weaknesses in common libraries can have the same reach. Because organisations cannot inspect everything they use, they depend on the security practices of suppliers they may not know exist.
- Which software and hardware components does a system contain, and where do they come from?
- How are build systems, update channels and code repositories protected against tampering?
- How sustainable is the maintenance of critical open-source components, and who funds it?
- How can buyers obtain credible evidence of suppliers' security practices?
Drivers and processes.
Supply chain risk arises at every stage from development to delivery and update.
Components and builds
Applications depend on many libraries, each with its own dependencies. Compromised build systems or update servers can distribute malicious code as a trusted update.
Devices and firmware
Firmware and hardware components can carry weaknesses that are hard to detect and fix, and replacement can take years.
Human foundations
Critical open-source projects may rely on a few volunteers. Burnout, takeover of abandoned projects or social engineering of maintainers create risk.
Supply chain incidents have shown two distinct patterns. In one, attackers compromise a supplier's build or update process so that a legitimate product delivers malicious code. In the other, a vulnerability in a widely used open-source component is discovered and must be found and fixed across countless systems. Both reward organisations that know what they run and can update it quickly.
How the evidence is built, and its limits.
- 01
Software bills of materials
Inventories of components in a product. They improve visibility but must be accurate and kept current to be useful.
- 02
Build provenance
Methods that record and verify how software was built, so tampering can be detected. Adoption is growing but uneven.
- 03
Dependency analysis
Graph analysis of software ecosystems, applying network science and contagion, identifies components on which many systems depend.
- 04
Hardware assurance
Testing and supply chain controls for hardware. Full verification is rarely feasible, so assurance relies on trusted processes.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyControl baselines and gap analysis · Exploited vulnerability prioritisationApplied here
- 02Software and safety-critical systems engineeringSecure development life cycle · Safety and security co-assuranceApplied here
- 03Network science and contagionAttack path analysis · Digital dependency concentration · Coordination detectionApplied here
Where this page's references lead.
The bodies and documents this page is read against. Status and editions change; each link goes to the issuing body.
- SLSA supply-chain levels for software artefacts (OpenSSF)
- SPDX software bill of materials specification, ISO/IEC 5962:2021
- NIST SP 800-161 Revision 1, cybersecurity supply chain risk management practices (NIST, 2022)
- Regulation (EU) 2024/2847, the Cyber Resilience Act
- NS-12, Software, model and AI/ML artefacts, a proposed standard
Questions and answers.
What is a software bill of materials?
What is a software supply chain attack?
What is SLSA?
Is open-source software riskier than proprietary software?
Can supply chain attacks be prevented?
Does the platform assess suppliers?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GCRISend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGCRISee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.