1. Home
  2. Knowledge Center
  3. Cyber A to Z
  4. Chapter 12
Protecting your systemsChapter 12

Code and the software supply chain

Open source dependencies, CVEs, SCA and SAST, SBOMs, secrets, supply chain attacks, SLSA, Sigstore and the Cyber Resilience Act, explained simply.

Nestor
Presented byNestor
11 min readUpdated on 2 October 2026

What you will learn

  • Understand why open source dependencies are a risk in their own right
  • Tell SCA, SAST, DAST and IAST apart, and know when to use each
  • Produce and use an SBOM in CycloneDX or SPDX format
  • Learn the lessons of Log4Shell, SolarWinds, xz-utils and poisoned packages
  • Prioritise fixes with CVSS, EPSS and the KEV catalogue
  • Know what the Cyber Resilience Act requires of software vendors

Free chapter with your account

Chapter 1 is free to read. Chapters 2 to 21, like the Junior, Senior and Expert levels of the Cyber Quiz, are free too: all you need is a free KrakenShield account with a confirmed email address.

Checking your access…

From theory to practice

So how does your system measure up?

Create your account and get an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Run the audit from your account: an A+ to F grade for your domains’ encryption in minutes, with every finding explained and the fix to apply.

Create your account Audit my domains See capabilities
Belinda

Contact us

A question, a project, a partnership? Write to us: the team answers by email, usually within one business day.

Your details are only used to answer you. Do not include passwords or vulnerability details.