Contactez-nous Suivez-nous sur Twitter En francais English Language

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN



Global Checkmarx Study Reveals 63% of Participating Organizations Have Fallen Victim to a Software Supply Chain Attack in Past Two Years

June 2024 by Checkmarx

As open source software grows to represent an ever-increasing percentage of enterprise application code, application security (AppSec) leaders and developers are challenged to mitigate the risk of falling victim to the weaponisation of such packages by threat actors. Reporting on current open source AppSec practices and problems, Checkmarx, the industry leader in cloud-native application security for the enterprise, has released its global research report, the 2024 State of Software Supply Chain Security. Notably, the study found that 100% of the large enterprises represented by 900 AppSec professionals responding from the United States, Europe and Asia-Pacific have been the victims of a software supply chain attack at some point.

“Software supply chain security has become an active target of government regulatory and cybersecurity agencies and is top of mind for over half of global enterprises we surveyed,” said Amit Daniel, Chief Marketing Officer at Checkmarx. “It’s critical for CISOs and security leaders to make it easier for developers to understand the new risks and secure their entire software supply chain. ‘Malicious’ is much more than vulnerable. We have seen more attacks on the open source ecosystem in the last two years than ever before with over 385,000 malicious packages detected to date by our own Checkmarx security research team. That’s why Checkmarx offers capabilities in Checkmarx One to allow developers to seamlessly add protection against such attacks."

The study revealed that:
• 56% of respondents’ organisational applications comprise open source code packages
• 75% of respondents said they were either very concerned (39%) or concerned (36%) about software supply chain security
• While 100% of organisations have experienced a software supply chain attack at some time in the past:
o 18% of respondents have been the victims of a software supply chain attack within the past year
o 63% had been the victims of such an attack within the past two years

While enterprise AppSec leaders surveyed are prioritizing software supply chain security, progress is slow:
• 57% said that software supply chain security was a top or significant area of focus
• 54% are planning to use or are investigating the use of a solution
• 50% are actively requesting software bills of materials (SBOMs) from their vendors
• Less than half of those seeking vendor SBOMs knew how to leverage them effectively if needed

In early 2024 Checkmarx commissioned a global research firm to conduct a survey of 900 CISOs and application security professionals in companies in North America, Europe and Asia-Pacific with annual revenue of $750 million or more.

See previous articles


See next articles

Your podcast Here

New, you can have your Podcast here. Contact us for more information ask:
Marc Brami
Phone: +33 1 40 92 05 55

All new podcasts