Software Supply Chain Security: Trust Exploitation vs Code Vulnerabilities

Black Hat 2026 analysis highlights the distinction between code vulnerabilities (Problem A) and trust exploitation (Problem B). Current SBOM/CVE-centric approaches insufficient. Vendors addressing trust exploitation are innovative and likely to see increased demand. Implications for CISOs and investors: need to move beyond compliance-driven checklists. Black Hat 2026 'Duck and Cover' thesis sharpens the trust exploitation problem, offering a vendor taxonomy for evaluating startups.