Software supply chains introduce systemic risk through base images, third-party dependencies and transitive components that outpace traditional vulnerability management. Mid-to-large organizations struggle to maintain development velocity while establishing accountability, visibility and prioritization across fragmented engineering environments. This topic presents a defensive framework that uses software bills of materials as a control plane to expose runtime risk, resolve ownership across layers, and reduce friction between security and engineering teams.

In this insightful session, Yadhu Krishna M., security engineer at CRED, will discuss:

• Detecting unapproved and outdated base images using layer-level analysis;
• Prioritizing vulnerabilities based on exposure, reachability and service criticality;
• Reducing remediation noise from shared and internal dependency packages.