SOFTWARE SUPPLY CHAIN ATTACK QUANTIFICATION: VECTORING AND PRIORITIZING DEFENSES

Purpose.Open and commercial source software has become a key element of the modern IT industry on the one hand, and targets for attackers on the other hand.The purpose of the article is identifying attacks vectors and prioritizing defenses from the most dangerous attacks for organizations computer infrastruture.Methodology.The methodology of this study includes aggregating quantitative data, categorizing the characteristics and impact of attacks, identifying annual trends, cross-checking the information, and transforming the results into actionable, prioritized recommendations.Quantitative analysis of attacks on software supply chains identifies key patterns of attack vectors based on data from known incident reports for the period 2018-2025.Findings.Open and commercial source software is used in cloud services and enterprise in critical industries: finance, healthcare, energy, and others.The study demonstrates the unprecedented growth and sophistication of these threats.There has been an overall increase in attacks by 430 % in recent years.By 2024, 75 % of all software supply chains have reported incidents.Projected annual losses will reach $60 billion by 2025 and $138 billion by 2031.Originality.Organizations face a multifaceted security challenge that requires a holistic and adaptive approach.Vulnerabilities in open source software, the opacity of commercial software, the rapid weaponization of published vulnerabilities, and the emergence of AI-driven threats create an ever-expanding attack surface.There are already known attacks using AI, geopolitically motivated cyberattacks.There is a gap in the readiness of organizations.Only every third organization is prepared to protect against threats.Attack vectors include exploitation of known vulnerabilities (especially in edge devices), compromise of open source repositories, insecure commercial software design, theft of developer credentials, and manipulation of CI/CD pipelines.Practical value.Based on this work, strategic decision-making and prioritization of security measures will not only impact protection against current threats, but also highlight current threats in order to create a resilient and adaptive security system that can withstand future challenges in the field of supply chain cybersecurity.Conclusions.Based on the research of current threats, protection measures are prioritized with a focus on the need to move to a comprehensive, proactive security strategy and prioritization of protection measures, which include strict vendor management, integration of security in the early stages of the software development lifecycle (DevSecOps), implementation of zero trust principles, training of development personnel and the use of advanced analytical tools for threat detection.