Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 236 controls, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
← All 25 domains
05Dependency Management
19 shown
Before any package is installed, do we know it is not malicious, not critically vulnerable in a reachable way, properly licensed and actively maintained?
Attacks counteredlow to high
- Counters none6
- Counters 1–26
- Counters 3–56
- Counters 6+1
- Table stakes2
Level 1
2 here
Level 2
8 here
- Adu36Automated Dependency Updates0 attacks countered
- Dcp37Dependency Confusion Prevention1 attacks countered
- Dpl38Dependency Pinning & Lockfile Integrity Verification2 attacks countered
- Elc39End-of-Life Component Detection0 attacks countered
- Mpd40Malicious Package Detection6 attacks countered
- Osp41Open Source Project Health Scoring1 attacks countered
- Tdr42Transitive Dependency Resolution0 attacks countered
- Td43Typosquatting Detection2 attacks countered
Level 3
7 here
- Dca44Dependency Curation & Allowlisting3 attacks countered
- Hpd45Hallucinated Package Detection2 attacks countered
- Isp46Install Script & Package Behavior Analysis3 attacks countered
- Ise47Install Script Execution Restriction3 attacks countered
- Mpr48Maintainer & Publisher Risk Analysis3 attacks countered
- Mra49Minimum Release Age Enforcement3 attacks countered
- Ra50Reachability Analysis0 attacks countered
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 159 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.