A new report from Omdia, highlighted in a Docker blog post, paints a stark picture: 77% of organizations experienced a software supply chain incident in the past year. The research underscores that despite increased investment in security tools, vulnerabilities persist—and developers are increasingly viewed as the primary defense against attacks that exploit the software build and delivery pipeline.
Key findings and implications for developers:
- Incident prevalence – The 77% figure marks a significant rise, indicating that supply chain attacks are now the norm rather than the exception. Omdia attributes this to the growing complexity of dependencies and the widespread adoption of open-source components.
- Top risks identified – The report names dependency confusion, typosquatting, and compromised CI/CD pipelines as leading attack vectors. Developers are urged to adopt habits like verifying package integrity and scrutinizing
package.json,requirements.txt, orgo.modfiles for unexpected changes. - Security gaps – A major gap is the lack of Software Bills of Materials (SBOMs) across many organizations, making it hard to track components post-breach. Omdia recommends integrating SBOM generation into build processes using tools like
syftortrivy. - Developer's role – The report emphasizes that developers, not just security teams, must be the first line of defense. This includes enforcing code signing, using multi-factor authentication for registry access, and adopting supply-chain security frameworks like SLSA (Supply-chain Levels for Software Artifacts) to validate build provenance.
- Practical steps – Docker's blog suggests leveraging Docker Scout for real-time vulnerability scanning and content trust features to ensure only verified images are pulled. For example, enabling Docker Content Trust with
export DOCKER_CONTENT_TRUST=1ensures that only signed images are used in your environment.
For developers, this isn't just about tools—it's about shifting left. Integrating security checks into local development environments, using SBOMs as a standard artifact, and treating each dependency as a potential risk are crucial. Omdia's findings reinforce that a proactive, developer-led approach is essential to mitigating what has become an industry-wide threat, transforming security from a separate function into an integral part of the coding workflow.
Source: https://www.docker.com/blog/software-supply-chain-security-omdia-2026-report/