How Omdia Sees the Firmware and Software Supply Chain Security Landscape in 2025

As regulations around connected devices tighten and threat actors evolve, organizations are being pushed to rethink how they approach software and firmware risk. The 2025 Omdia Market Radar: Firmware and Software Supply Chain Security report offers a clear view into what matters now—and what’s coming next.

This report goes beyond surface-level vendor comparisons. Omdia explores what defines leadership in this space, why device-level visibility matters, and how innovation in Software Bill of Materials (SBOM) management, vulnerability triage, and binary analysis is shaping security outcomes. If you’re responsible for software risk in your organization, this analysis is worth your attention.

Firmware Security Moves to the Forefront

Omdia’s report highlights a shift: firmware security, once considered a niche concern, is now a critical part of software supply chain security (SSCS). The reason is simple—code within devices isn’t just another layer. It's foundational to how connected systems behave, and it often contains hidden risks that go undetected in traditional scanning workflows that focus on source code analysis.

Many organizations, especially those in healthcare, transportation, and critical infrastructure, can’t access the source code powering the operational systems and devices they purchase. That makes binary analysis a prerequisite for understanding risk. According to Omdia, this is why leading vendors in the space are focused on analyzing compiled artifacts, the code that actually executes.

The SBOM Landscape Has Matured

SBOMs are no longer a nice-to-have, or even just a compliance checkbox. Omdia notes a sharp transition from simple SBOM generation to robust SBOM management. That includes:

• Organizing SBOMs as living assets
• Comparing and merging SBOM data across builds
• Analyzing SBOMs for known vulnerabilities, cryptographic risk, or exposure to third-party AI models
• Automating compliance reporting using formats like VEX (Vulnerability Exploitability eXchange)

Regulatory momentum plays a role here. U.S. Executive Order 14028 mandates SBOM use for suppliers to the federal government. Similar mandates are emerging globally, including the EU Cyber Resilience Act (EU CRA) and DORA in Europe, Singapore’s Cybersecurity Labelling Scheme (CLS) Japan’s Cyber/Physical Security Framework (CPSF), and China’s MLPS 2.0 framework. While the regulations are region specific, they apply to vendors who sell into those regions, making them critical to U.S. companies operating globally. Beyond compliance, SBOMs are becoming a primary data source for software risk decisions. Omdia also expects the rise of CBOMs (cryptographic bills of materials) and AIBOMs (AI bills of materials) to further expand the scope of supply chain visibility.

NetRise Earns Recognition for Innovation and Technical Depth

In its vendor assessment, Omdia highlighted which vendors are pushing the boundaries of software supply chain innovation—and where technical leadership is emerging. NetRise received the highest designations—”Advanced,” meaning “Very Strong,” in:

• SBOM generation and management
• Vulnerability management and triage
• Innovation and strategy

Omdia specifically called out NetRise’s innovation around AI-assisted search, operational SBOM use, and binary-first analysis—technical differentiators that help teams move from visibility to action. By focusing on compiled code rather than just source code, NetRise enables both device manufacturers and security analysts to assess the risk of what actually executes, even when the original code isn't available.

The platform also supports risk scoring, VEX generation, and context-rich prioritization, helping you avoid alert fatigue while focusing on what matters most.

Binary vs. Source Code Analysis: Why Both Matter

According to Omdia, most SSCS vendors fall into one of two technical camps:

• Source Code Analysis (SCA): This approach inspects code early in development. It’s useful for internal teams but has limited reach when working with third-party software or proprietary components.
• Binary Analysis: This examines compiled code, which makes it especially useful for asset owners, third-party risk teams, and any situation where you don’t control the original source.

Some vendors now support both approaches, and Omdia expects this trend to continue. For example, your development team might use SCA tools internally, while your security operations team needs binary visibility into commercial off-the-shelf software or firmware in the field.

NetRise's strength lies in its binary-first methodology. You can analyze compiled firmware, create accurate SBOMs, and uncover vulnerabilities that never surface in source code scans. This complements—not competes with—your existing tools.

What’s Coming Next: Proactive, Lifecycle-Aware Security

Omdia calls attention to a growing need for SBOM enrichment, not just generation. That includes integrating with CI/CD pipelines, surfacing CWEs (Common Weakness Enumerations) early, and helping teams prioritize risks in context. The report notes that vendors must evolve beyond simple detection and toward automation, triage, and lifecycle integration.

NetRise’s roadmap reflects this shift. Omdia highlights the following technical focus areas:

• Expanding support for compiled artifact analysis across more device types
• Automating triage workflows and risk scoring
• Adding runtime analysis via agent-based scanning for cloud and endpoint environments
• Supporting developers with SBOM comparison and merge features
• Detecting zero-days through reachability and contextual weakness analysis
  
  

These capabilities support what Omdia sees as the future of SSCS: real-time insight into the software that actually executes, paired with automation to guide remediation and compliance.

Why This Matters for You

Whether you're building connected medical devices or managing risk across an industrial control network, you need more than static inventory. You need visibility into the compiled software and firmware your organization relies on. More importantly, you need that visibility to drive action, not overwhelm your team with noise.

Omdia’s 2025 analysis provides a clear signal in a noisy market. It identifies the capabilities that matter most, context-aware SBOM management, binary inspection, automation, and strategic innovation, and points to the vendors advancing the state of the art.

If you're reassessing how you approach software supply chain security, this is a report worth a close read.