Security engineering6 MIN READ
Your dependency graph is part of your attack surface
A software bill of materials tells you what you ship. Controlling supply-chain risk needs three further things: provenance for the build, a policy for adoption, and a rehearsed route to replace a component quickly.