One Chain to Shackle Them All

## Supply Chain as Permanent Risk

A Siemens product-security veteran presents "One Chain to Shackle Them All" at FIRST, arguing software supply chains create a never-ending vulnerability chain shackling vendors and consumers alike. Managing over 10,000 products, his team disclosed roughly a thousand vulnerabilities last year—manual scale impossible to sustain through automation alone.

## Two-Party Models Fail

CVSS environmental scores, legal vendor-customer contracts, and SSVC decision frameworks assume binary relationships. Real supply chains contain many hops: component authors, integrators, OEMs, distributors, and end operators. Vulnerabilities propagate instantly downstream while patches travel slowly upstream.

## Patch Propagation Asymmetry

Illustrative timelines show fixes taking months per hop—potentially over two years from initial disclosure to final deployer. Meanwhile exploit knowledge spreads immediately. Organizations still patching 2022 flaws while attackers chain current CVEs exemplify systemic lag no single vendor can solve.

## Toward Collective Accountability

The speaker urges industry-wide coordination: transparent dependency graphs, synchronized disclosure windows, and realistic expectations that "just automate patching" ignores integration testing, safety certification, and OT downtime constraints. Supply-chain security requires multi-stakeholder mechanisms, not bilateral SLAs.