{"id":21156,"date":"2025-05-14T11:00:33","date_gmt":"2025-05-14T09:00:33","guid":{"rendered":"https:\/\/cyberinsights.iainfraser.net\/?p=21156"},"modified":"2026-06-15T15:01:20","modified_gmt":"2026-06-15T13:01:20","slug":"software-supply-chain-risk","status":"publish","type":"post","link":"https:\/\/smecyberinsights.co.uk\/index.php\/2025\/05\/14\/software-supply-chain-risk\/","title":{"rendered":"SME CYBER THREAT INTEL: Software Supply Chain Risk Leaves UK SMEs Vulnerable"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"Partners1_NordVPN\"<\/figure><\/div>
\"Partners3_R3\"<\/figure><\/div>
\"Partners2_Zoho\"<\/figure><\/div>
\"Partners4_Plesk\"<\/figure><\/div>
\"Red_Button_Slider\"<\/figure><\/div>
\"ogo2\"<\/figure><\/div>
\"Detection.<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Freepik\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Designed by Freepik<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Helping Keep Small Business CYBERSafe!
\n<\/strong>Gibraltar: Wednesday 14 May 2025 at 11:00 CET<\/p>\n

SME CYBER THREAT INTEL: Software Supply Chain Risk Leaves UK SMEs Vulnerable<\/strong><\/p>\n

By Ben Hedges \u2013 Staff Writer
\n<\/a>SMECyberInsights.co.uk<\/a> \u2013 First for SME Cybersecurity <\/a>SMECYBERInsights<\/a> \u2013\u00a0The UK Small Business Cybersecurity Network
\n<\/a>Google Indexed on 140525 at 12:56 CET<\/a>
\n#SMECyberInsights #SMECyberSecurity #SMECyberAwareness #CyberSafe #SME #SmallBusiness<\/em><\/span><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Alan Carson, Cloudsmith’s<\/strong><\/a> CSO and co-founder, emphasised the fundamental issue: “Without visibility, you can’t control your software supply chain. And without control, there’s no security.”<\/em><\/p>\n

The research findings come as regulatory pressure intensifies, with the EU Cyber Resilience Act and updated guidelines from the Cybersecurity and Infrastructure Security Agency (CISA) pushing for stronger safeguards in software development practices. UK SMEs, particularly those with EU trading relationships or compliance requirements, will need to adapt to these changing regulatory landscapes.<\/p>\n

The Security-Speed Balance<\/strong><\/p>\n

The Cloudsmith<\/strong><\/a> research indicates that while 61% of software development professionals prioritise security features in their workflows, nearly half (46%) describe their software delivery pipelines as having limited or no automation, with inefficient processes and minimal use of centralised artifact repositories.<\/p>\n

For UK SMEs<\/strong><\/a>, this highlights a common dilemma: balancing the need for rapid software development and deployment with essential security considerations. Many smaller businesses lack the infrastructure to maintain visibility over their entire software supply chain, potentially exposing them to significant risks.<\/p>\n

“There’s a clear disconnect between security goals and real-world implementation,”<\/em> noted Nigel Douglas, Developer Relations Lead at Cloudsmith<\/strong><\/a>. “Since open-source code is the backbone of today’s software supply chains, any weakness in dependencies or artifacts can create widespread risk.”<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"Freepik\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: Designed by Freepik<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

Recommendations for UK SMEs<\/strong><\/p>\n

Based on the research findings, UK SMEs<\/strong><\/a> should consider reassessing their current cybersecurity protocols with a specific focus on software supply chain security:<\/p>\n

1. Conduct a software supply chain audit<\/strong>: Identify all components, dependencies, and third-party software used within your business.<\/p>\n

2. Implement centralised artifact management<\/strong>: Consider adopting tools that provide visibility into software components and dependencies.<\/p>\n

3. Automate security scanning<\/strong>: Deploy automated tools to continuously monitor for vulnerabilities in software dependencies.<\/p>\n

4. Develop clear policies<\/strong>: Establish guidelines for developers regarding the use of open-source components and third-party software.<\/p>\n

5. Stay informed about regulations<\/strong>: Monitor developments in the EU Cyber Resilience Act and UK cybersecurity frameworks to ensure ongoing compliance.<\/p>\n

Industry experts suggest that improved security doesn’t necessarily require massive investment. As Carson points out, “Security doesn’t have to come at the cost of speed. DevOps leaders are crying out for a single plane to bring [their development processes] together and simplify management, making security a default layer, rather than an extra obligation.”<\/em><\/p>\n

For UK SMEs<\/strong><\/a>, addressing these software supply chain vulnerabilities now could prevent costly breaches in the future and ensure compliance with evolving regulatory requirements.<\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tJoin SME Cyber Insights Now! \/...<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\"CYBERInsights\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t
Image Credit: IfOnlyCommunications<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t

SMECYBER Insights \u2013 Helping Keep Small Business CYBERSafe!\u00a0<\/strong><\/p>\n

Launched in 2020 by\u00a0Cybersecurity Journalist<\/a>\u00a0Iain Fraser<\/strong>\u00a0and his team at\u00a0IfOnly…<\/strong><\/a> SMECYBERInsights<\/strong><\/a> was developed to be the go-to platform providing definitive, reliable & actionable Cybersecurity News, Intel,\u00a0 Awareness & Training specifically written and curated for Small Business<\/strong><\/a> & Enterprise Owners, Partners and Directors throughout the UK.\u00a0#SMECyberInsights #SMECyberSecurity #CyberAttack #CyberAwareness\u00a0 #Compliance #DDoS #Fraud #Ransomware #ScamAlert #SME #SmallBusiness #SmallBusinessOwner #ThreatIntel <\/span>\u00a0<\/em><\/p>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t\t
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"_CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Report<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>
\"CI_Feature<\/figure><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\t
\n\t\t\t\t\t\t<\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

Image Credit: Designed by Freepik Image Credit: Designed by Freepik Join SME Cyber Insights Now!…<\/p>\n","protected":false},"author":1,"featured_media":21157,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"yes","footnotes":""},"categories":[440],"tags":[439],"ppma_author":[505],"class_list":["post-21156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyberthreat-intel","tag-cyberthreat-intel"],"featured_image_urls":{"full":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith.jpg",1430,978,false],"thumbnail":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-150x150.jpg",150,150,true],"medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-300x205.jpg",300,205,true],"medium_large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-768x525.jpg",640,438,true],"large":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-1024x700.jpg",640,438,true],"1536x1536":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith.jpg",1430,978,false],"2048x2048":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith.jpg",1430,978,false],"covernews-featured":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-1024x700.jpg",1024,700,true],"covernews-medium":["https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2025\/05\/Freepik-Cloudsmith-540x340.jpg",540,340,true]},"author_info":{"display_name":"Cybersecurity Journalist Iain Fraser","author_link":false},"category_info":"SME CYBER\/THREAT INTEL<\/a>","tag_info":"SME CYBER\/THREAT INTEL","comment_count":"0","authors":[{"term_id":505,"user_id":1,"is_guest":0,"slug":"admin_yjdstq4n","display_name":"Cybersecurity Journalist Iain Fraser","avatar_url":{"url":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png","url2x":"https:\/\/smecyberinsights.co.uk\/wp-content\/uploads\/2024\/10\/index_image440-removebg-preview.png"},"author_category":"1","user_url":"http:\/\/smecyberinsights.co.uk","last_name":"Cybersecurity Journalist","first_name":"Iain Fraser","job_title":"","description":""}],"_links":{"self":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/comments?post=21156"}],"version-history":[{"count":11,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21156\/revisions"}],"predecessor-version":[{"id":29607,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/posts\/21156\/revisions\/29607"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media\/21157"}],"wp:attachment":[{"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/media?parent=21156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/categories?post=21156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/tags?post=21156"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/smecyberinsights.co.uk\/index.php\/wp-json\/wp\/v2\/ppma_author?post=21156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}