Supply chain
5 posts
26 min read
eMudhra TLS certificate compromise: browsers are fixed, your estate is not
Eight eMudhra certificate authority keys were so weak anyone could recover them. Chrome and Firefox blocked them in hours. Servers, containers and Java did not.
- Cryptography
- Supply chain
- Third-party risk
19 min read
Shopify fake checkout attack: how hijacked apps redirected shoppers
Hijacked Shopify apps sent shoppers from real stores to fake checkout pages that took card details. The verified timeline, how it worked, and what to do now.
- Supply chain
- Third-party risk
- Vendor risk
19 min read
AI supply chain security: four ways code now enters your estate without a vendor review
Model weights, agent skills, MCP servers and packages your coding assistant invented all execute in your environment, and none of them trigger a vendor assessment. The documented incidents, the measured scale, and the controls that close the gap before CPS 230 makes it an audit finding.
- Supply chain
- Third-party risk
- AI agents
3 min read
Securing CI/CD pipelines without slowing engineering down
Pipeline security is the gap between policy and reality. Most regulated firms have written rules about code review and signed releases that the actual pipeline does not enforce, and the audit evidence is whatever the runner happened to print to stdout.
- CI/CD
- Platform engineering
- Supply chain
6 min read
Third-party risk after the supply-chain attack era
Most third-party risk programs in mid-market financial services are questionnaire factories. They produce paperwork; they do not produce risk reduction. After several years of supply-chain incidents, the realistic position has changed. Here's what actually works.
- Supply chain
- Third-party risk
- Vendor management
Get started
Talk to the security lead who would do the work.
A thirty-minute discovery call costs nothing. We confirm fit, scope, and timing, then issue a fixed-fee statement of work within two business days.