Law and Security Merge as Supply Chain Regulations Multiply: RSA Panelists
Contract renewal timelines at large companies can run three years, making last-minute compliance impractical.
SAN FRANCISCO, March 26, 2026 — Software vulnerabilities, hardware blind spots, and an expanding web of global regulations are redefining how companies must manage their supply chains, legal and security executives told the RSA Conference here on Wednesday.
The attack surface
Supply chains are more digitalized and more complex than ever, expanding the attack surface and multiplying individual points of failure, said Cassie Crossley, chief executive of VulNow, a cybersecurity vulnerability detection startup.
Just this week, a software supply chain attack compromised Trivy, an open-source vulnerability scanning tool used in AI development pipelines, Crossley said. Developers have been compromised again, she said, and the full extent of what was stolen remains unknown.
