thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Software Supply Chain Failures

OWASP Top 10 2025 category (A03) for compromises or weaknesses in dependencies, build systems and distribution infrastructure.

Definition

Expands the 2021 Vulnerable and Outdated Components category to include malicious packages, compromised build pipelines, unsigned artifacts and weak developer environment controls. Mitigations include SBOMs, SCA, pinned and verified dependencies, signed builds with provenance (SLSA), and protecting CI/CD.

Example

A compromised maintainer account publishes a malicious version of a popular package that the app auto-updates to.

Exam tip

New in the 2025 list; ranked highest by the community survey.

Related terms