Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
25 domains · 348 products
Read it in order. The domains run the supply chain from start to end — governance and design, then code and the dependencies it pulls, then build, registry and deployment, then what it takes to operate the result. Position is the chain, not our page count: a domain with two controls is narrow because that part of the field is narrow, and the question on each tile says what it is for.
The bar on each tile is the spread of maturity levels inside it, palest first. A domain that is all level 3 and 4 asks more of a program than one with a level 1 floor, and the count alone does not say which.
- 01GRC8products
Governance, Risk & Compliance
Can leadership see, at any moment, which security requirements every product and pipeline meets — and who accepted the risk where it does not?
8 products · 0 scored
- 02DESIGN10products
Secure Design & Threat Modeling
For every data flow that crosses a trust boundary, do we know the threats, the controls that stop them and the tests that prove those controls work?
10 products · 0 scored
- 03DEVSEC10products
Developer Security & Secure Coding
Do developers get accurate security feedback before they push, and are their tools — including AI assistants — prevented from introducing secrets, vulnerable code or malicious packages?
10 products · 0 scored
- 04SAST20products
Static Code Analysis
Is every change to first-party code analyzed for exploitable vulnerabilities before merge, with findings accurate enough that developers act on them?
20 products · 17 scored
- 05DEPS24products
Dependency Management
Before any package is installed, do we know it is not malicious, not critically vulnerable in a reachable way, properly licensed and actively maintained?
24 products · 3 scored
- 06SBOM12products
SBOM & Component Visibility
If a component is compromised today, can we list every product, version and deployment that contains it — and whether it is exploitable — within an hour?
12 products · 0 scored
- 07SECRETS24products
Secrets & Identity Security
If any pipeline, repository or developer machine were fully compromised today, which long-lived credentials would the attacker get — and how fast could we revoke them?
24 products · 1 scored
- 08CICD10products
CI/CD Pipeline Security
Could an attacker who controls a pull request, a third-party action or a mutable tag run code in our pipeline with access to secrets or publishing rights?
10 products · 1 scored
- 09SCM8products
Source Control Security
Can any single person, token or app change a protected branch, a release tag or a workflow without independent review and an audit trail?
8 products · 0 scored
- 10BUILD19products
Build Integrity & Cryptographic Trust
For any artifact in production, can we cryptographically prove which commit, which build platform and which inputs produced it?
19 products · 1 scored
- 11REGISTRY13products
Package Registry & Provenance Security
Can anything reach a developer, build or production cluster that was not published by the expected pipeline and verified against its provenance?
13 products · 0 scored
- 12CONTAINER24products
Container Security
Does every production image come from an approved minimal base, carry a signature and SBOM, and get rebuilt when its base is patched?
24 products · 2 scored
- 13IAC11products
Infrastructure-as-Code Security
Is every infrastructure change reviewed against security policy as code before it is applied, and do we detect changes made outside of code?
11 products · 0 scored
- 14VALIDATE25products
Runtime Application Validation
Do we test our running applications and exposed surfaces often enough to find what attackers would find first — and verify our fixes actually work?
25 products · 0 scored
- 15API12products
API Security
Do we know every API we expose, and have we proven each one enforces object- and function-level authorization?
12 products · 0 scored
- 16K8S24products
Runtime & Kubernetes Protection
Can only verified, policy-compliant workloads run in our clusters, and would we detect a container behaving like an attacker within minutes?
24 products · 0 scored
- 17CLOUD14products
Cloud Security Posture
Do we know, right now, which cloud resources are exposed or over-privileged, which attack paths reach sensitive data, and who owns the fix?
14 products · 0 scored
- 18IAM16products
Identity & Access Management
If one engineer's identity were phished today, what could the attacker reach — and would MFA, least privilege or detection stop them?
16 products · 0 scored
- 19VENDOR12products
Vendor Governance
For each supplier and integration with access to our code, pipeline or data, do we have current evidence of their security and a plan if they are compromised?
12 products · 0 scored
- 20DR12products
Detection & Response
If a dependency, action or maintainer account we rely on were compromised tonight, how quickly would we know, and have we rehearsed exactly what to do?
12 products · 0 scored
- 21EVM15products
Exposure & Vulnerability Management
Of all our open findings, do we know which few are actually exploitable in production, who owns each one, and whether last month's fixes really worked?
15 products · 2 scored
- 22AI16products
AI Model & Agent Security
Do we know every model, agent and AI tool in use, where each model came from, and what each agent is allowed to do without a human?
16 products · 0 scored
- 23ENDPOINT6products
Endpoint Protection
Would we detect and stop an attacker executing code on a developer workstation or build server?
6 products · 2 scored
- 24DATA2products
Data Protection
Do we know where our sensitive data is and who and what can access it?
2 products · 0 scored
- 25EMAIL1products
Email & Collaboration Security
Would a targeted phishing email to a maintainer or engineer be blocked or detected?
1 products · 0 scored
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 227 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.