Form cover
Page 1 of 2

Software Supply Chain Security: Current Practices and Challenges

This short survey is part of an independent personal research project I am planning to pursue in 2026. Its aim is to better understand how organisations approach software supply chain security in practice, highlighting the tools and methods in use in the real world, where friction tends to occur, and where confidence may be lower. Through this survey, I am particularly interested in identifying which aspects of current supply chain security approaches work well in day-to-day operations, and where they are perceived as insufficient or difficult to apply in practice.

This is not a sales or marketing exercise. Participation is entirely voluntary and anonymous, and the survey takes approximately 3–5 minutes to complete. Responses will be used solely to identify patterns and common themes across roles and organisations, for personal research and learning purposes only.

Section A - User Context

Q1. Which best describes your role?

Q1. Which best describes your role?
A
B
C
D
E
F

Q2. What is your organisation size?

Q2. What is your organisation size?
A
B
C
D

Q3. How would you describe your organisation?

Q3. How would you describe your organisation?
A
B
C
D

Q4. Roughly how many third-party software suppliers or dependencies do you rely on?

Q4. Roughly how many third-party software suppliers or dependencies do you rely on?
A
B
C
D
E

Q5. Which team is the most involved in third-party software risk in your organisation?

Q5. Which team is the most involved in third-party software risk in your organisation?
A
B
C
D
E

Section B - Current Practices and Reality

Q6. How do you currently assess the risk of third-party software suppliers?

Q6. How do you currently assess the risk of third-party software suppliers?
A
B
C
D
E
F

Q7. Which of the following do you actively use today? (multi-select)

Q7. Which of the following do you actively use today? (multi-select)
A
B
C
D
E
F

Q8. Today most of your supplier trust is based on:

Q8. Today most of your supplier trust is based on:
A
B
C

Q9. When was the last time you updated your risk view of an existing supplier?

Q9. When was the last time you updated your risk view of an existing supplier?
A
B
C
D
E

Q10. If a supplier’s risk posture changed tomorrow (new dependency, new CVE, compromised component), how quickly would you know?

Q10. If a supplier’s risk posture changed tomorrow (new dependency, new CVE, compromised component), how quickly would you know?
A
B
C
D
E
F

Q11. When a critical dependency vulnerability is disclosed, what usually happens?

Q11. When a critical dependency vulnerability is disclosed, what usually happens?
A
B
C
D
E

Q12. Has your organisation ever had to explain software integrity or provenance to a customer or regulator?

Q12. Has your organisation ever had to explain software integrity or provenance to a customer or regulator?
A
B
C
D

Q13. How important is continuous visibility into supplier software risk for your organisation today?

Q13. How important is continuous visibility into supplier software risk for your organisation today?
Not importantCritical

Section C – Perceived Limitation and Open Challenges

Q14. What is the hardest part of managing third-party software risk today? (Select up to 3)

Q14. What is the hardest part of managing third-party software risk today? (Select up to 3)
A
B
C
D
E
F
G
H
I

Q15. Which aspects of your current supply-chain security processes or tools cause the most friction today? (Select up to 3)

Q15. Which aspects of your current supply-chain security processes or tools cause the most friction today? (Select up to 3)
A
B
C
D
E
F
G
H

Q16. How confident are you that what suppliers declare matches what is actually deployed?

Q16. How confident are you that what suppliers declare matches what is actually deployed?
Not confident at allVery Confident

Q17. Where do you feel least confident in your current approach?

Q17. Where do you feel least confident in your current approach?
A
B
C
D
E
F

Q18. Have you ever discovered a serious issue after software was already deployed?

Q18. Have you ever discovered a serious issue after software was already deployed?
A
B
C

Section D – Perceptions and Desired Outcomes

Q19. Which statement do you agree with most?

Q19. Which statement do you agree with most?
A
B
C
D
E

Q20. In an ideal world, what would you want to be able to say with confidence? (Select any that resonate)

Q20. In an ideal world, what would you want to be able to say with confidence? (Select any that resonate)
A
B
C
D
E

Q21. If you could remove one problem from your current supply-chain security approach, what would it be?

Q22. What would success look like for you one year from now regarding supply-chain risk?

Q23. Who would most likely own or sponsor a solution that improves the way in which your company handles supply chain security?

Q23. Who would most likely own or sponsor a solution that improves the way in which your company handles supply chain security?
A
B
C
D
E
F

Q24. Which statement best reflects your situation?

Q24. Which statement best reflects your situation?
A
B
C
D