Fragile by Design: Large-Scale Evidence of Software Supply Chain Risk

Key Takeaways

Large-scale proof the supply chain is brittle:
Drawing on millions of analysed binaries, firmware images, and software artefacts, the keynote argues systemic risk is widespread—and often missed by traditional AppSec tooling.
The numbers show “blind trust” is failing:
Findings include 88% of firmware images with 100+ known vulnerabilities , 50%+ with hardcoded credentials , and 60%+ using outdated/unsupported components —signals of ecosystem-level weakness, not edge cases.
Binaries reveal reality—and visibility enables assurance:
Pace contrasts source code/manifests (intent) with compiled binaries (truth), making the case that compiled-code visibility is foundational to real software assurance and to finding hidden issues before they become incidents.