Supply chain compromise is MITRE’s term for manipulating a product, service, or delivery mechanism before it reaches the end user. Instead of attacking an organization directly, an adversary targets a trusted upstream step such as a vendor, dependency, build system, update channel, or managed service.
This matters because it turns trust into an attack path. A malicious change can arrive looking legitimate, which makes detection harder and lets one compromise affect many downstream systems. In real attacks, this technique may involve altered software packages, tampered updates, poisoned source repositories, or compromised firmware and components.
Defenders reduce this risk by verifying provenance and integrity, using code signing, maintaining SBOMs, applying secure development practices, and managing supplier risk through C-SCRM programs. The goal is to make it harder for hidden changes to enter the environment unnoticed.