About the Software Supply Chain Security category
What belongs in this category
The Software Supply Chain Security category covers products that protect everything software passes through on its way to production: source repositories, build systems, third-party dependencies, container images and the artifacts that ship. Typical entries detect malicious packages and tampered builds, sign and verify artifacts, record where each build came from (provenance), harden pipeline settings and permissions, and help meet frameworks such as SLSA (Supply-chain Levels for Software Artifacts).
Risk in open source components alone fits Open Source Security, and creating and sharing software bills of materials fits SBOM Management. The supply chain of AI models and datasets fits AI Supply Chain Security, and assessing the security of vendors as businesses fits Third Party Risk Management (TPRM). SDLC security products, whose own category was retired, can choose this category or DevSecOps. Supply chain products may enter Application Security too.
Related categories to enter
Each category is judged separately, so you can enter a product in every category that matches what it does, with a separate nomination for each. Tailor each nomination to that category's focus. Entering several related categories gives the product more than one chance to be recognized.
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against organizations of similar size and region, so a mid-sized firm is not ranked against a global enterprise. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the software the product protects: repositories, pipelines and artifacts covered, packages analyzed, and customers that rely on it to trust what they build and ship.
- Innovation — a supply chain problem solved in a new way, such as catching malicious packages before they are installed, provenance that proves how each build was made, or protection that needs no change to developer workflows.
- Impact — results for customers: malicious or tampered components blocked, pipelines hardened, artifacts signed and verified, audit requirements met. Give figures from customers.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A vendor can enter its own product or service, and a PR agency can enter it on a client's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as customer names, deployment figures or roadmap. Deadlines, pricing and entry steps are on the How it Works page.
