The definitive annual report on open-source and software supply chain risk.
The report quantifies the explosion in open-source usage, the rise of malicious packages, and the gap between available fixes and adoption. It is essential reading for AppSec, DevSecOps, and platform teams.
FAQs
Sonatype's State of the Software Supply Chain analyzes open-source consumption, malicious package trends, and dependency risk across millions of projects. Published annually, it is the leading benchmark for software supply chain security.
Sonatype State of the Software Supply Chain is based in Fulton, MD, USA.
Sonatype State of the Software Supply Chain is listed in the Research & Reports category of Cyber Resources, the curated directory of the cybersecurity marketing and growth ecosystem.
New York, USA
The Verizon DBIR analyzes thousands of confirmed breaches and security incidents contributed by law enforcement, forensic firms, and cyber insurers to map how breaches happen and who is behind them. Published annually, it is the most widely cited breach benchmark in the industry.
Armonk, USA
IBM's Cost of a Data Breach Report surveys hundreds of breached organizations across more than a dozen countries to quantify average breach cost, time to identify and contain, and cost factors such as AI governance and shadow AI. Research is conducted independently by the Ponemon Institute.
Reston, USA
Mandiant's M-Trends draws on hundreds of thousands of hours of incident-response engagements to report on dwell time, initial infection vectors, and threat-actor tactics. A 17+ year staple for defenders, now published under Google Cloud.
Start your 7-day free trial and get your AI Visibility Score in about a minute. See exactly where you stand, where competitors are beating you, and the ranked fixes to get into the answer. Cancel anytime before the trial ends.
7-day free trial. Cancel anytime before it ends. Trusted by 500+ B2B SaaS teams.
