Software supply chain security needs unified risk measurement methods
Measuring the Security of the Evolving Software Supply Chain: a Research Agenda
Cryptography and SecuritySoftware Engineering
Summary
Modern software relies heavily on code from many other sources, creating a complex web of dependencies that can have hidden security problems. The authors find that current tools to measure risks in these software supply chains don't work well across different software ecosystems and often miss how vulnerabilities spread, especially in indirect dependencies. They suggest a unified way to measure and understand these connections more consistently. Also, they point out that new ways to write code using AI tools may introduce new types of dependencies that existing security checks don't catch.
What this means in practice
- •For software security teams: Develop cross-ecosystem risk assessment frameworks that better capture indirect dependency vulnerabilities in software projects.
- •For software tool developers: Create new tools to analyze evolving dependency patterns introduced by AI-assisted code generation beyond traditional scanning methods.
A position paper. It proposes an approach and reports no results.
Authors
Sarah Meriem Ourari
Abstract
Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largely fragmented and ecosystem-specific, limiting their ability to provide comparable risk assessments across environments. This paper presents a structured research plan, starting with a Systematization of Knowledge (SoK) to synthesize the current state of research and identify key gaps, highlighting the limitations in dependency modeling and vulnerability propagation analysis, particularly in the treatment of transitive dependencies and their real-world exploitability. Based on these insights, we argue for a unified measurement perspective capable of consistently representing and analyzing the cross-ecosystem dependency structure. We further identify emerging challenges introduced by AI-assisted software development, where coding LLMs are likely to contribute to new dependency patterns that are not captured by traditional Software Composition Analysis (SCA) tools. These shifts motivate a rethink of dependency modeling to account for evolving software-generation practices and their long-term structural impact on software security.