Skip survey header

2025 Software Supply Chain Security Survey

Welcome!

The survey should take ~10 minutes. Your answers will help teams across the globe navigate their most pressing software supply chain security challenges and uncover strategies to mitigate risk.

We'll analyze responses and publish our findings in our upcoming Software Supply Chain Security Trend Report, scheduled for release this June. Thank you for your participation!

 
1. How does your organization utilize software bills of materials (SBOMs) in your software development and security processes?
How frequently is your organization's SBOM updated?
How is your organization's SBOM shared or made accessible? Select all that apply.
What formats does your organization primarily use for its SBOMs? Select all that apply. 
2. How often does your organization scan applications to detect and identify vulnerabilities?
3. In what ways are you implementing AI/ML to detect and/or mitigate risk at your organization? Select all that apply.
4. At what stage in the SDLC does your organization first implement security? 
This question requires a valid percent format.
100
6. Which of the following security tools/tests are integrated into your DevOps pipeline? Select all that apply. 
7. Which of the following software supply chain threats impact your organization? Select all that apply.
What are your biggest challenges related to managing security across a complex toolchain? Select all that apply. 

The AI Factor

8. Which security measures does your organization leverage AI to secure your software supply chains? Select all that apply.
9. What are your greatest challenges when leveraging AI to strengthen and secure your software supply chains? Select all that apply. 

The Rise of Zero Trust

10. Which zero-trust components are actively being implemented in your organization? Select all that apply.
11. What types of tools or platforms are you using to support your zero-trust architecture? Select all that apply. 
12. What strategies does your organization currently use to minimize its software supply chain attack surface? Select all that apply. 
13. How confident are you in your organization's ability to build trust across systems and services (e.g., ensuring secure inter-service communication)?

Managing Cloud and Open-Source Security Postures

14. What practices do you use to manage and mitigate open-source security risks? Select all that apply.
15. Which best describes your organization's adoption of SCA tools?
What benefits have you observed from using SCA tools? Select all that apply.  
16. What cloud environments does your organization operate in? Select all that apply. 
What security strategies are most critical to your hybrid or multi-cloud environments? Select all that apply. 
17. Does your organization use Infrastructure as Code (IaC)? 
How frequently does your organization detect misconfigurations in IAC?
What types of IaC-related issues are most commonly found in your pipelines? Select all that apply. 
Are you using Policy as Code to enforce infrastructure security standards? 

Governance and Data Privacy

18. How prepared is your organization for meeting evolving regulatory compliance standards (e.g., GDPR, CCPA)?
19. How often do you review or update your software supply chain to remain compliant with regulations? 
20. Which compliance-related practices are currently implemented at your organization? Select all that apply.
21. Which IAM practices are in place across your software development and deployment environments? Select all that apply.
22. What data protection methods are currently in use across your CI/CD workflows? Select all that apply. 

Modern Threat Detection

23. How would you rate your organization's ability to detect and respond to incidents across the software supply chain? 
24. What challenges does your organization face in reducing downtime or improving incident response? Select all that apply.
25. Has your organization adopted AI/ML-powered tools for threat detection within the software supply chain? 
What benefits have you seen from the use of AI/ML for threat detection? Select all that apply. 
26. What is your current SIEM (Security Information and Event Management) status? 
What are the biggest challenges or benefits you've experienced with SIEM? Select all that apply. 

Background and Experience

Information from the questions below will enable us to provide a more granular analysis of survey responses based on factors such as technical role, programming language, and years' experience.

Note: Answers remain anonymous unless you choose to enter the raffle. Emails will be used for raffle purposes only.
 
27. What types of software are you currently developing? Select all that apply.
28. What programming language ecosystems does your company use? Select all that apply.
29. What is your primary programming language at work?
Response should be between 0-60 This question requires a valid number format.
31. What best describes your primary role in your company? *This question is required.
32. What is the size of your organization in terms of employees? *This question is required.
33. Do you wish to enter the survey raffle?
Note: You must be a DZone member to enter (you can join here).
0%