- Software supply chain risk is no longer a periodic audit exercise—it is a primary driver of rework, schedule slips, and degraded mission readiness. As government organizations and their industry partners strive to deliver software faster while navigating increasingly complex threats and software ecosystems, teams need practical controls that improve delivery predictability without slowing development.
In this session, Thomas Tapley, Product Manager at Sonatype, explains how leading organizations are moving from disconnected point solutions to an integrated software supply chain management approach that spans the full software development lifecycle.
Attendees will learn a practical operating model to:
Prevent malicious or high-risk components from entering development environments through controlled intake and pre-use protections.
Govern component selection with automated, policy-driven enforcement across developer workflows, CI/CD pipelines, and release processes.
Prove software readiness through continuously updated SBOMs and real-time visibility into software supply chain risk.
Using real-world examples and lessons learned, this session demonstrates how organizations can reduce costly rework, respond more quickly to newly disclosed vulnerabilities, and deliver mission software on time and on budget—without sacrificing security, developer productivity, or operational resilience.
