SCA Is No Longer Relevant: Insights From the Founder of Black Duck

I founded Black Duck Software in December 2002, and served as its first CEO for many years. Black Duck has long been recognized as a pioneer in open-source compliance and vulnerability management. Since its inception, it has played a pivotal role in shaping the software composition analysis (SCA) industry. My deep history with Black Duck, combined with my early contributions to the SCA space, provides me with a unique perspective on the evolving challenges facing application security (AppSec).

A New Era of Software Supply Chain Attacks

The landscape of cyber threats has shifted. The rise of sophisticated attacks, such as those targeting SolarWinds Orion and 3CX, demonstrates that adversaries are no longer simply exploiting software vulnerabilities — they are infiltrating development pipelines, and injecting malicious code into trusted software before it even reaches end users.

Today’s software supply chain threats extend well beyond outdated open-source packages with known, exploitable Common Vulnerabilities and Exposures (CVEs) — the focus of traditional SCA tools, and an area in which they have historically excelled. Attackers are now leveraging weaknesses in continuous integration/continuous delivery (CI/CD) pipelines, open-source package repositories, code-signing mechanisms, as well as closed source, third-party software modules to compromise software integrity before it is even deployed.

This evolving threat landscape requires organizations to expand their AppSec focus. Visibility must extend beyond open-source dependencies and licensing issues to include build artifacts, proprietary code, and third-party applications.

The Gap in Traditional SCA

The reality today is that most SCA solutions have not kept pace with the changing threat landscape, leaving organizations exposed to risks they simply cannot detect. And despite the rapid evolution of software supply chain threats, many SCA vendors continue to concentrate on known vulnerabilities in open-source libraries — often overlooking the more pressing risks posed by sophisticated code tampering and malware injection.

While the generation of software bills of materials (SBOMs) remains valuable, it is not sufficient to eradicate software supply chain threats — especially when it is only focused on the open-source components. Modern applications are comprised of a complex mix of proprietary, third-party, and open-source components, along with machine learning (ML) model training data, compiled binaries, and other critical build artifacts. AppSec solutions must evolve to meet the demands of these complex supply chains.