--- title: Software Supply Chain Cybersecurity | SUMāTO description: "Why software depends on hundreds of third-party components and how to manage it: SBOM, dependencies, and vendors. By Andrés Lozada, SUMāTO." image: https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png --- [Skip to content](https://sumatogroup.com/en/insights/blog/ciberseguridad-cadena-suministro#main-content) - [INSIGHTS](https://sumatogroup.com/en/insights) - [SUPPORT](https://sumatogroup.com/en/support) - [CONTACT](https://sumatogroup.com/en/contact) EN [Español](https://sumatogroup.com/insights/blog/ciberseguridad-cadena-suministro) [English](https://sumatogroup.com/en/insights/blog/ciberseguridad-cadena-suministro) [![SUMāTO Group — home](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SMT%20-%20LOGO.png?width=40&height=40&name=SMT%20-%20LOGO.png)](https://sumatogroup.com/en) - [HOME](https://sumatogroup.com/en/) - About #### SUMāTO - [About us→](https://sumatogroup.com/en/about-us) - [Terms→](https://sumatogroup.com/en/legal) - [Legal→](https://sumatogroup.com/en/legal) - [Cookies→](https://sumatogroup.com/en/legal) - [Data protection→](https://sumatogroup.com/en/legal) #### METHODOLOGIES - [Design Thinking→](https://sumatogroup.com/en/methodologies#design-thinking) - [Lean Startup→](https://sumatogroup.com/en/methodologies#lean-startup) - [PMI→](https://sumatogroup.com/en/methodologies#pmi) - [Scrum→](https://sumatogroup.com/en/methodologies#scrum) #### Vendors - [AWS→](https://sumatogroup.com/en/vendors#aws) - [Cisco→](https://sumatogroup.com/en/vendors#cisco) - [Dahua→](https://sumatogroup.com/en/vendors#dahua) - [Fortinet→](https://sumatogroup.com/en/vendors#fortinet) - [Huawei→](https://sumatogroup.com/en/vendors#huawei) - [Microsoft→](https://sumatogroup.com/en/vendors#microsoft) - [OCI→](https://sumatogroup.com/en/vendors#oci) - [Panduit→](https://sumatogroup.com/en/vendors#panduit) - Capabilities #### TECHNOLOGY - [Artificial Intelligence→](https://sumatogroup.com/en/artificial-intelligence) - [Data Analytics→](https://sumatogroup.com/en/data-analytics) - [Automation→](https://sumatogroup.com/en/automation-rpa) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity) - [Cloud→](https://sumatogroup.com/en/cloud) #### SEGMENTS - [SMB→](https://sumatogroup.com/en/smb) - [Enterprise→](https://sumatogroup.com/en/enterprise) - [Government→](https://sumatogroup.com/en/government) - Consulting #### Assessments - [AI Readiness→](https://sumatogroup.com/en/ai-readiness-assessment) - [Analytics→](https://sumatogroup.com/en/data-analytics-maturity-assessment) - [Cloud→](https://sumatogroup.com/en/cloud-readiness-assessment) - [Cybersecurity→](https://sumatogroup.com/en/cybersecurity-assessment) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-assessment) - [IT Maturity→](https://sumatogroup.com/en/it-maturity-assessment) - [IT Strategy→](https://sumatogroup.com/en/technology-strategy-assessment) - [Process Automation→](https://sumatogroup.com/en/process-automation-assessment) #### Consulting & Architecture - [AI First→](https://sumatogroup.com/en/ai-first) - [BCP→](https://sumatogroup.com/en/business-continuity-plan) - [DRP→](https://sumatogroup.com/en/disaster-recovery-plan) - [Enterprise Architecture→](https://sumatogroup.com/en/enterprise-architecture-togaf) - [Enterprise Transformation→](https://sumatogroup.com/en/enterprise-transformation) - [IT Strategic Plan→](https://sumatogroup.com/en/it-strategic-plan) - [Strategic Consulting→](https://sumatogroup.com/en/strategic-consulting) - Operations #### INFRASTRUCTURE - [Data Center→](https://sumatogroup.com/en/data-center) - [Managed Services→](https://sumatogroup.com/en/managed-services) - [VDI→](https://sumatogroup.com/en/vdi) - [Intelligent Video Surveillance→](https://sumatogroup.com/en/video-surveillance) #### SECURITY - [NOC→](https://sumatogroup.com/en/noc) - [SOC→](https://sumatogroup.com/en/soc) #### USERS - [Modern Desktop→](https://sumatogroup.com/en/modern-desktop) - [Help Desk→](https://sumatogroup.com/en/help-desk) - Industries Industries - [Banking & Finance→](https://sumatogroup.com/en/banking-finance) - [Insurance→](https://sumatogroup.com/en/insurance) - [Government→](https://sumatogroup.com/en/government) - [Healthcare→](https://sumatogroup.com/en/healthcare) - [Telecommunications→](https://sumatogroup.com/en/telecommunications) - [Retail & Consumer→](https://sumatogroup.com/en/retail) - [Manufacturing→](https://sumatogroup.com/en/manufacturing) - [Energy, Oil & Gas→](https://sumatogroup.com/en/energy-oil-gas) - [Education→](https://sumatogroup.com/en/education) - [Logistics & Transportation→](https://sumatogroup.com/en/logistics-transport) - [Legal Services→](https://sumatogroup.com/en/legal-services) - [Engineering & Construction→](https://sumatogroup.com/en/engineering-construction) - Resources #### CONTENT - [Blog→](https://sumatogroup.com/en/insights) - [Use cases→](https://sumatogroup.com/en/use-cases) #### EVENTS - [Webinars→](https://sumatogroup.com/en/webinars) EN [Español](https://sumatogroup.com/insights/blog/ciberseguridad-cadena-suministro) [English](https://sumatogroup.com/en/insights/blog/ciberseguridad-cadena-suministro) Search - There are no suggestions because the search field is empty. [Ciberseguridad](https://sumatogroup.com/en/insights/tag/ciberseguridad) # Software Supply Chain Cybersecurity [Andrés Lozada](https://sumatogroup.com/en/insights/author/andres-lozada) · Apr 14, 2022, 8:00:00 AM · 7 min read When a vulnerability in a logging library almost no one had heard of put half the internet at risk late last year, many executives discovered an uncomfortable truth: they didn't even know that component lived inside their applications. The software your company buys, licenses, or builds is not a single piece; it is an assembly of hundreds of third-party parts, and each one is a potential door. In 2022, securing that supply chain stopped being a specialists' topic and became a boardroom priority. **The short version:** Modern software is built on hundreds of open-source and commercial components you did not write or control. Protecting the supply chain requires knowing what is inside your applications (through an SBOM), managing the vulnerabilities of those dependencies, and verifying that what you run is what your vendors actually delivered. It is a discipline of inventory, governance, and verifiable trust. ## Why your software is no longer only yours A decade ago, an enterprise application was mostly proprietary code. Today the ratio has flipped: between 70% and 90% of a typical application is made up of open-source libraries, frameworks, SDKs, and third-party services. Each dependency brings, in turn, its own dependencies (so-called transitive dependencies), so an application that declares twenty libraries can pull in several hundred indirect components. This architecture accelerates development, but it shifts the risk. You no longer trust only your own programmers: you trust thousands of anonymous maintainers, public repositories, and each vendor's processes. An attacker who compromises a single popular package can reach, in one stroke, every organization that uses it. The attack surface no longer ends at your perimeter; it stretches across the entire chain that produced your software. ## What an SBOM is and why you need one An **SBOM** (Software Bill of Materials) is the complete, structured list of every component that makes up an application: the name, version, origin, and license of each part. It is the digital equivalent of the ingredient list on a food product. Without it, when a critical vulnerability appears you cannot answer the only question that matters: "Are we affected, and where?" The value of an SBOM shows precisely in a crisis. Organizations with up-to-date inventories could locate vulnerable components in hours; those without spent weeks on manual searches while the exposure window stayed open. A strong SBOM program includes: - **Automatic generation** with every build, not as a one-off document that ages the moment it is signed. - **A standard, machine-readable format** (such as CycloneDX or SPDX) so you can query it and integrate it with your tools. - **Coverage of transitive dependencies**, not just the direct ones you declared. - **A requirement on vendors** to deliver the SBOM of the software they sell you. ## Dependency and vulnerability management Having the inventory is the starting point; the ongoing work is to cross-check it continuously against known-vulnerability databases and act with judgment. Not all alerts are equal, and treating them all with the same urgency exhausts teams without reducing real risk. Mature management prioritizes by three factors: the technical severity of the flaw, whether an active exploit is circulating, and whether the affected component is genuinely exposed in your context. A critical vulnerability in a library that is never invoked in production can wait; a medium-severity one in an internet-facing service probably cannot. We recommend: - **Software composition analysis** integrated into the pipeline, halting builds that contain known-vulnerable components. - **An update policy** that keeps dependencies close to their supported versions, avoiding the technical debt that makes patching impossible. - **Version pinning** so that a build is reproducible and no one introduces silent changes. - **Internal service-level agreements** for the maximum remediation time based on criticality. ## Vendor assessment: trust that is demonstrated A large part of your supply chain is made up of commercial software vendors and cloud services. Here the question stops being technical and becomes one of governance: how does that third party develop, test, and deliver its product? A vendor with weak practices turns their weaknesses into yours. Assessment must be built into the buying process, not added after signing. It pays to demand evidence, not promises: recognized certifications, results of independent security testing, documented secure development practices, and a clear commitment to notify you when they themselves suffer an incident. The key question for every critical vendor is simple: if tomorrow you discover a serious vulnerability in your product, when and how will I find out? Our [cybersecurity](https://sumatogroup.com/ciberseguridad) team helps organizations build these assessment frameworks. ## Signing and verification: making sure what you run is what you received The final link is integrity. A sophisticated attacker does not need to find a flaw in the code: it is enough to alter the artifact between the moment the vendor builds it and the moment you install it. Cryptographic signing solves this by letting you verify that a component comes from who it claims to and has not been modified along the way. - **Signing artifacts** at the source, so that every package, container, or binary carries verifiable proof of its authenticity. - **Mandatory verification** before deployment: reject anything not properly signed. - **Provenance** that documents how, where, and from what each artifact was built. - **Protection of the build chain**, because the environment that produces your software is as valuable a target as the software itself. ## Continuous detection and response Even with inventories, patches, and signatures, no chain is impregnable. That is why continuous vigilance closes the loop: correlating the activity of your applications and vendors to detect anomalous behavior before it becomes an incident. A [SOC](https://sumatogroup.com/soc) that monitors continuously turns the SBOM and dependency management into real response capability, not filed documentation. The difference between the companies that came through the last crisis calmly and those that did not was not luck: it was preparation. ## Frequently asked questions ### Is an SBOM only for companies that build software? No. Any organization that uses software (that is, all of them) benefits from requiring SBOMs from its vendors. Even if you don't write code, you need to know which components run inside the applications you buy so you can react when a vulnerability appears. ### Isn't a good antivirus and firewall enough? Those tools protect the perimeter and the endpoints, but they don't tell you which third-party components live inside your applications or whether they are compromised. Supply chain security is a distinct, complementary layer, focused on the origin and integrity of software. ### Where do I start if I have none of this? With the inventory. You can't protect what you don't know. Generating an SBOM of your most critical applications will give you, in a few weeks, visibility you likely don't have today and will reveal the most urgent risks. ### How long does it take to implement a program like this? The first capabilities (inventory and dependency analysis) can be operational in weeks. Full maturity, with vendor assessment and signature verification integrated, is a journey of months best tackled in prioritized phases. ## The first step Software supply chain security is not bought as a product: it is built as a discipline, layer by layer, starting with knowing what is really inside your systems. At SUMāTO, we help organizations in the region move from uncertainty to a concrete, measurable program, with clear priorities and early results. If the last crisis left you wondering "would we be affected?", that is exactly the starting point. [Let's talk](https://sumatogroup.com/contacto) about how to bring visibility and control to your software supply chain. Continue reading - [DRP: When Every Minute Counts](https://sumatogroup.com/en/insights/blog/drp-cada-minuto-cuenta) - [Operational Resilience: DR as a Service (DRaaS)](https://sumatogroup.com/en/insights/blog/draas-resiliencia) Next step Do you know where you are exposed today, and what to remediate first? [Cybersecurity Assessment →](https://sumatogroup.com/en/cybersecurity-assessment) [Ciberseguridad](https://sumatogroup.com/en/insights/tag/ciberseguridad) ![Andrés Lozada](https://sumatogroup.com/hs-fs/hubfs/SPEAKERS/AL.jpeg?width=56&height=56&name=AL.jpeg) Andrés Lozada Apr 14, 2022, 8:00:00 AM [LinkedIn](https://www.linkedin.com/in/andreslozada/) ### Explore more from SUMāTO [Enterprise AI](https://sumatogroup.com/en/artificial-intelligence) [Enterprise Transformation](https://sumatogroup.com/en/enterprise-transformation) [Strategic Consulting](https://sumatogroup.com/en/strategic-consulting) [AI Agent](https://sumatogroup.com/en/artificial-intelligence) [AI Contact Center](https://sumatogroup.com/en/artificial-intelligence) [Cybersecurity](https://sumatogroup.com/en/cybersecurity) ### Related Posts #### [Log4Shell: The Vulnerability That Shook the Software World](https://sumatogroup.com/en/insights/blog/log4shell-vulnerabilidad) On December 9, 2021, a single line of malicious text was enough to take control of servers across the planet. The cause: a flaw in Log4j, a logging... #### [The Global Outage from an Update: Lessons in Resilience](https://sumatogroup.com/en/insights/blog/caida-global-actualizacion) On July 19, 2024, millions of screens around the world turned blue at almost the same moment. Airports halted boarding, hospitals postponed... #### [Testing automations: quality control for processes that run alone](https://sumatogroup.com/en/insights/blog/pruebas-automatizaciones-control-calidad) **An automation that runs unattended has no user to notice when it goes wrong. That single property is why testing it is a different discipline from...** ![SUMāTO](https://sumatogroup.com/hs-fs/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png?width=200&height=100&name=SUM%C4%81TO%20%7C%20LOGO%201000x500.png) Strategic technology planning consultants. AI, Analytics, Cloud and Cybersecurity ## Navigation [Home](https://sumatogroup.com/en) [Capabilities](https://sumatogroup.com/en/artificial-intelligence) [Consulting](https://sumatogroup.com/en/strategic-consulting) [Operations](https://sumatogroup.com/en/managed-services) [Industries](https://sumatogroup.com/en/banking-finance) [Resources](https://sumatogroup.com/en/insights) ## SUMāTO [About](https://sumatogroup.com/en/about-us) [Terms](https://sumatogroup.com/en/legal#terminos) [Legal & Privacy](https://sumatogroup.com/en/legal) [Data protection](https://sumatogroup.com/en/legal) Cookies ## [Contact](https://sumatogroup.com/en/contact) [sales@sumatogroup.com](mailto:sales@sumatogroup.com) Mexico HQ Mexico City, Mexico [+52 55 8897 5791](tel:+525588975791) Bogotá Bogotá, Colombia [+57 601 724 5059](tel:+576017245059) © 2026 SUMāTO Group. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Andrés Lozada", "url" : "https://sumatogroup.com/en/insights/author/andres-lozada" }, "dateModified" : "2026-07-09T19:30:30.410Z", "datePublished" : "2022-04-14T13:00:00.000Z", "headline" : "Software Supply Chain Cybersecurity | SUMāTO", "mainEntityOfPage" : { "@id" : "https://sumatogroup.com/en/insights/blog/ciberseguridad-cadena-suministro", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://sumatogroup.com/hubfs/BRANDING/Logo_SUMATO_Original%20-%201000x500.png" }, "name" : "SUMāTO Group" } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. Any organization that uses software (that is, all of them) benefits from requiring SBOMs from its vendors. Even if you don't write code, you need to know which components run inside the applications you buy so you can react when a vulnerability appears." }, "name" : "Is an SBOM only for companies that build software?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Those tools protect the perimeter and the endpoints, but they don't tell you which third-party components live inside your applications or whether they are compromised. Supply chain security is a distinct, complementary layer, focused on the origin and integrity of software." }, "name" : "Isn't a good antivirus and firewall enough?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "With the inventory. You can't protect what you don't know. Generating an SBOM of your most critical applications will give you, in a few weeks, visibility you likely don't have today and will reveal the most urgent risks." }, "name" : "Where do I start if I have none of this?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The first capabilities (inventory and dependency analysis) can be operational in weeks. Full maturity, with vendor assessment and signature verification integrated, is a journey of months best tackled in prioritized phases." }, "name" : "How long does it take to implement a program like this?" } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#organization", "@type" : "Organization", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "alternateName" : [ "SUMāTO Group", "SUMATO Group", "Sumato Group", "SUMATO", "SUMaTO", "SUMaTO Group", "SUMTO", "SUMTO Group" ], "areaServed" : [ { "@type" : "Country", "name" : "México" }, { "@type" : "Country", "name" : "Colombia" }, { "@type" : "Place", "name" : "Latinoamérica" } ], "contactPoint" : { "@type" : "ContactPoint", "areaServed" : "Latinoamérica", "availableLanguage" : [ "es", "en" ], "contactType" : "sales", "email" : "sales@sumatogroup.com" }, "description" : "SUMāTO is a Latin American technology consulting and integration firm founded in 2016, with a presence in Mexico and Colombia. It designs, implements and operates artificial intelligence, data analytics, automation, cybersecurity and cloud on the systems a client already runs, under governance frameworks such as NIST AI RMF and ISO/IEC 42001.", "foundingDate" : "2016", "knowsAbout" : [ "Inteligencia Artificial", "IA Generativa", "Agentes de IA", "Analítica de Datos", "Big Data", "Automatización de Procesos (RPA)", "Ciberseguridad", "Computación en la Nube", "Continuidad del Negocio y Recuperación ante Desastres", "Arquitectura Empresarial", "Transformación Digital" ], "legalName" : "SUMāTO Group", "location" : [ { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "MX", "addressLocality" : "Huixquilucan", "addressRegion" : "Estado de México", "postalCode" : "52787", "streetAddress" : "Av. Vialidad de la Barranca No. 6, Torre 1, Suite 400, Piso 4, Col. Bosques de las Palmas" }, "name" : "SUMāTO MX", "telephone" : "+52 55 8897 5791" }, { "@type" : "Place", "address" : { "@type" : "PostalAddress", "addressCountry" : "CO", "addressLocality" : "Bogotá", "streetAddress" : "Cra. 45 # 103-34, Of. 202" }, "name" : "SUMāTO CO", "telephone" : "+57 601 724 5059" } ], "logo" : { "@type" : "ImageObject", "height" : 500, "url" : "https://sumatogroup.com/hubfs/BRANDING/SUM%C4%81TO%20%7C%20LOGO%201000x500.png", "width" : 1000 }, "name" : "SUMāTO", "sameAs" : [ "https://www.linkedin.com/company/sumatogroup", "https://www.youtube.com/@sumatogroup", "https://torre.ai/teams/SUMaTOGroup", "https://www.cbinsights.com/company/sumto-group", "https://elioplus.com/profiles/channel-partners/57295/sumato-group" ], "telephone" : "+52 55 8897 5791", "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://sumatogroup.com/#website", "@type" : "WebSite", "description" : "Technology consulting in AI, data, automation, cybersecurity and cloud across Latin America.", "inLanguage" : "en", "name" : "SUMāTO", "publisher" : { "@id" : "https://sumatogroup.com/#organization" }, "url" : "https://sumatogroup.com" } ``` ```json { "@context" : "https://schema.org", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://sumatogroup.com/en", "name" : "Home", "position" : 1 }, { "@type" : "ListItem", "item" : "https://sumatogroup.com/en/insights/blog/ciberseguridad-cadena-suministro", "name" : "Software Supply Chain Cybersecurity", "position" : 2 } ] } ```