Customer Story

Local Municipality: Streamlining the Third-Party Software Approval Process with Spectra Assure

A local municipality partnered with ReversingLabs to operationalize Spectra Assure™ as part of their supply chain risk management program, aligning with NIST 800-53 controls. Like any organization that relies on third-party software, the city’s GRC and Security teams needed to prioritize business velocity without sacrificing security controls. With constituents spread across multiple local agencies, GRC and Security team members often faced questions as to why certain software is not permitted for use, despite being deemed business-critical by end users. The GRC and Security teams needed a way to clearly showcase embedded software risks to these non-technical stakeholders and demonstrate what secure, trusted software looks like.

Spectra Assure provides the most comprehensive SBOM and risk analysis, and is securely shareable. This allows the GRC officer to quickly analyze software requests, and then share the Spectra Assure SAFE Report with internal stakeholders and vendors to communicate and support their Go/No-Go decision. 

  • Local Municipality
  • United States
  • 16,000
  • Government
FacebookFacebookXX / TwitterLinkedInLinkedIn

Expert Insights

Primary Control for Third-Party Software Requests

With an end user population of roughly 16,000, the city’s GRC and Security Operations teams face a high volume of requests from end users to download and deploy untested third-party commercial software. Previously, the city relied on security rating services which provided only a high-level overview of a software provider’s risk exposure, but no details into the vendor’s security practices or the software package itself. Security and GRC stakeholders recognized that this would not prevent malicious software from being installed on end user devices. 

Spectra Assure provided the city’s GRC and Security Operations teams with a primary control to assess whether third-party software packages were safe to use. Spectra Assure’s complex binary analysis provided immediate value by deconstructing and analyzing software in minutes without the need for source code. For example, it analyzed a popular free-to-use file management software in minutes, highlighting a number of security issues in the process. This approach provides the city’s GRC and Security Operations the information they need to make informed decisions on whether to accept or deny software requested by end users across multiple departments and agencies.

Comprehensive Software Risk Summaries

The city’s Governance, Risk, and Compliance (GRC) Office uses Spectra Assure to analyze commercial and freemium software packages requested by their end users to determine if a software package is safe to deploy to their environment or end user machines. 

The shareable Spectra Assure SAFE Report provided the Security and Risk staff a means to identify and report on the dangers of software threats like malware, vulnerabilities, and suspicious behaviors. Security issues are clearly labeled and categorized by risk category and indicate which findings are in direct violation to the agency’s security policy. For stakeholders outside the Security and Risk organization, SAFE reports provide a digestible means to understand how third-party software packages expose the city to unnecessary risk.

Alignment with NIST 800-53

With software supply chain risk as a growing priority for the local government, Spectra Assure provides the Security and GRC organizations with the necessary controls to comply with NIST’s security standards. The city’s third-party risk management strategy is rooted in NIST 800-53 controls but lacks an automated control to assess software required by their constituents. 

Spectra Assure’s analysis serves as the de facto Go/No-Go decision point for the city’s third-party risk management framework. The city uses criteria outlined in NIST 800-53 to determine whether third-party software is eligible for analysis and ongoing monitoring. This criteria includes factors such as pervasiveness of the software, privileged access, interaction with critical infrastructure, and interaction with essential services – to name a few. Software packages that meet these criteria go through Spectra Assure as the primary control, enabling the GRC and Security teams to apply security best practices to their software acquisition process. 

Schedule a DemoContact Sales

bluesky
Bluesky
Email Us
Download Story

We get a lot of requests to install different applications. Spectra Assure lets us know if that software is safe or not, and simplifies that 'yes' or 'no' discussion with employees.

Security Operations Manager, Local Municipality

Challenges

  • No primary control for third-party software
  • Cannot capture third-party software risk
  • Alignment with NIST 800-53 controls

Solution

  • Spectra Assure provides the most comprehensive SBOM & risk assessment of third-party software identifying malware, tampering, and more

Results

  • Spectra Assure provides de facto Go/No-Go deployment decision
  • Detailed risk assessments for all incoming third-party software packages
  • Alignment with industry best practices

All RL Solutions

  • Spectra Assu

Want to Learn More?

Schedule a DemoContact Sales
municipality

Spectra Assure Free Trial

Get your 14-day free trial of Spectra Assure for Software Supply Chain Security

Get Free TrialMore about Spectra Assure Free Trial
Blog
Events
About Us
Webinars
In the News
Careers
Demo Videos
Cybersecurity Glossary
Contact Us
reversinglabsReversingLabs: Home
Privacy PolicyCookiesImpressum
All rights reserved ReversingLabs © 2026
XX / TwitterLinkedInLinkedInFacebookFacebookInstagramInstagramYouTubeYouTubeblueskyBlueskyRSSRSS
Back to Top
The inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security is outGET THE REPORT
Skip to main content
Contact UsSupportBlogCommunity
reversinglabs
ReversingLabs: Home
Solutions
Secure Software OnboardingSecure Build & ReleaseVerify AI Supply ChainIntegrate Safe Open SourceGo Beyond the SBOM
Increase Email Threat ResilienceDetect Malware in File Shares & StorageAdvanced Malware Analysis SuiteICAP Enabled Solutions
Scalable File AnalysisHigh-Fidelity Threat IntelligenceCurated Ransomware FeedAutomate Malware Analysis Workflows
Products & Technology
Spectra Assure®Software Supply Chain SecuritySpectra DetectHigh-Speed, High-Volume, Large File AnalysisSpectra AnalyzeIn-Depth Malware Analysis & Hunting for the SOCSpectra IntelligenceAuthoritative Reputation Data & Intelligence
Spectra CoreIntegrations
Industry
Energy & UtilitiesFinanceHealthcareHigh TechPublic Sector
Partners
Become a PartnerValue-Added PartnersTechnology PartnersMarketplacesOEM Partners
Alliances
Resources
BlogContent LibraryCybersecurity GlossaryConversingLabs PodcastEvents & WebinarsLearning with ReversingLabsWeekly Insights Newsletter
Customer StoriesDemo VideosDocumentationOpenSource YARA Rules
Company
About UsLeadershipCareersSeries B Investment
EventsBlack Hat 2026
Press ReleasesIn the News
Pricing
Software Supply Chain SecurityMalware Analysis and Threat Hunting
Request a demo
Menu
ciso survival

CISO Survival Guide: Operationalizing Third-Party Software Risk Management

Learn More about CISO Survival Guide: Operationalizing Third-Party Software Risk Management
CISO Survival Guide: Operationalizing Third-Party Software Risk Management
why safe why now title card

Why SAFE. Why Now.

RL's new Spectra Assure SAFE report sharpens the insights for supply chain risk assessments and adds powerful controls for the software you build or buy. Here’s how it works — and why it matters.

Learn More about Why SAFE. Why Now.
Why SAFE. Why Now.
Assess Third-Party Software Risk Without the Need for Source Code

Assess Third-Party Software Risk Without the Need for Source Code

Learn More about Assess Third-Party Software Risk Without the Need for Source Code
Assess Third-Party Software Risk Without the Need for Source Code