Software & Supply Chain Security
Summary: Dragos describes a supply chain security approach that pairs software bills of materials with binary analysis of the compiled artifact, on the argument that an attestation states what should be in a product while binary analysis shows what is. The company cites a 44% failure rate for AI-generated code in security testing, a figure it says has held steady across four years and more than 100 models, and notes that Executive Order 14028, the EU Cyber Resilience Act, NERC CIP, NIS2, and TSA security directives increasingly require organizations to document what is inside the software running their operations.
Key Takeaway: The gap between what a vendor attests it shipped and what binary analysis finds in the compiled artifact is where unreviewed components, credentials, and misconfigurations sit - and with 44% of AI-generated code failing security testing, that gap is being fed by code no developer on the project vetted.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026