Supply chain attacks do not respect tool boundaries
Every major supply chain incident crossed multiple layers that organizations scan with separate, non-communicating tools: dependencies, build pipelines, artifacts, secrets, and infrastructure. Attackers exploit the seams between scanners. Defense means covering every layer and correlating the findings in one place, because the risk picture only exists in combination.
Look closely at the supply chain incidents that defined the last decade and a pattern emerges that has nothing to do with any single vulnerability class. The compromise of a build system shipped signed malicious updates to thousands of organizations. A hijacked utility library executed inside every downstream application that trusted it. A tampered CI tool quietly exfiltrated credentials from the pipelines that ran it. A backdoor was discovered partway into infiltrating one of the most widely deployed compression libraries in the world.
Different years, different techniques, one constant: each attack crossed layers. Dependency to build system. Build artifact to credential. Credential to infrastructure. And each layer, in a typical organization, is watched by a different tool that has never heard of the others.
The seams are the attack surface
Organizations do not lack scanners. They lack continuity between them. The dependency scanner sees packages but not the pipeline. The container scanner sees images but not the git history. The secrets scanner sees credentials but not which service exposes them. Each produces its own queue, owned by a different team, in a different console.
An attacker moving through the chain, malicious package, then build access, then stolen token, then lateral movement, appears in each console as a separate, medium-priority curiosity. The pattern that would scream compromise exists only in the union of the views, and nobody is looking at the union.
What layer-by-layer coverage actually requires
Mapping the historical attack paths gives the checklist:
- Dependencies: complete graphs with exploitation-aware prioritization, because the hijacked library arrives as an ordinary version bump.
- Secrets: history-deep scanning, because pipeline credentials are the pivot in half these stories.
- Artifacts and containers: images and archives unpacked and verified, because the tampered layer ships from the registry, not the repo.
- Build definitions and infrastructure: pipeline and IaC configuration scanned like the production code it effectively is.
- Provenance: SBOMs per release and signed outputs, so what you shipped is provable later, which is the question regulators now ask.
Most organizations have three of the five, in silos. The incidents happened in the gaps and the seams.
Correlation is the actual defense
Coverage without correlation reproduces the silo problem with better tools. The defensive property that matters is the joined view: the vulnerable dependency, the leaked credential, and the misconfigured runtime on the same service is a different fact than any of them alone, and a dashboard that correlates across engines can see it. Stable identity across scans matters here too: fingerprint-keyed findings let the picture accumulate over time instead of resetting with every rescan.
The same joined view answers the post-incident question that takes siloed teams weeks: when the next hijacked-library disclosure lands, “which of our shipped builds carry it, and what else is on those services” should be minutes against stored inventories, not an archaeology project.
The honest boundary
No scanning stack detects a sufficiently sophisticated upstream compromise on day zero; the most famous near-miss backdoor in recent memory was caught by luck and one engineer’s attention to a performance anomaly. What layered, correlated coverage does is shrink the blast radius and the response time: fewer usable seams on the way in, faster answers on the way out, and evidence throughout. That is the realistic promise, and it is worth having.
The place to start is an inventory of your own seams: which layers are scanned, which findings ever meet each other, and who would see the pattern. If the answer to the last question is “nobody, structurally,” that is the gap to close first.