The code you didn't write - invisible threats in modern software development

Modern software is no longer written so much as assembled. Today's applications are built atop thousands of third-party, open-source, and commercial components—most of which developers never directly inspect or control. This creates a fundamental security problem: the majority of an application's attack surface originates from code no one on the team actually wrote, vetted, or maintains. High-impact incidents such as Log4Shell, SolarWinds, and the XZ Utils backdoor demonstrate how a single compromised dependency can propagate silently and devastatingly across entire ecosystems.

This talk examines the hidden risks embedded in modern software supply chains and explains why traditional vulnerability-centric security approaches consistently fail. Drawing on real-world incidents, supply chain economics, and operational case studies, it reframes supply chain attacks as an attacker force multiplier rather than an isolated threat class. 

The session focuses on how transitive dependencies, opaque build pipelines, and misaligned incentives combine to externalize risk onto downstream consumers.This presentation emphasizes practical, defensible strategies that have demonstrated results: component provenance, continuous asset visibility, least-functionality dependency management, and incentive realignment across developers, vendors, and executives. 

Key findings show that organisations focusing on provenance and runtime visibility—not just CVE scanning—significantly reduce blast radius and response time when supply chain failures occur. Ultimately, this talk argues that defending modern software requires seeing—and governing—the code you didn't write.