Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 236 controls, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
25 domains · 236 controls · ★15 table stakes
Read it in order. The domains run the supply chain from start to end — governance and design, then code and the dependencies it pulls, then build, registry and deployment, then what it takes to operate the result. Position is the chain, not our page count: a domain with two controls is narrow because that part of the field is narrow, and the question on each tile says what it is for.
The bar on each tile is the spread of maturity levels inside it, palest first. A domain that is all level 3 and 4 asks more of a program than one with a level 1 floor, and the count alone does not say which.
- 01GRC9controls
Governance, Risk & Compliance
Can leadership see, at any moment, which security requirements every product and pipeline meets — and who accepted the risk where it does not?
1 with no product · ★1
- 02DESIGN7controls
Secure Design & Threat Modeling
For every data flow that crosses a trust boundary, do we know the threats, the controls that stop them and the tests that prove those controls work?
1 with no product
- 03DEVSEC10controls
Developer Security & Secure Coding
Do developers get accurate security feedback before they push, and are their tools — including AI assistants — prevented from introducing secrets, vulnerable code or malicious packages?
7 comparable · 1 with no product · ★3
- 04SAST7controls
Static Code Analysis
Is every change to first-party code analyzed for exploitable vulnerabilities before merge, with findings accurate enough that developers act on them?
7 comparable
- 05DEPS19controls
Dependency Management
Before any package is installed, do we know it is not malicious, not critically vulnerable in a reachable way, properly licensed and actively maintained?
7 comparable · 2 with no product · ★2
- 06SBOM10controls
SBOM & Component Visibility
If a component is compromised today, can we list every product, version and deployment that contains it — and whether it is exploitable — within an hour?
2 comparable
- 07SECRETS11controls
Secrets & Identity Security
If any pipeline, repository or developer machine were fully compromised today, which long-lived credentials would the attacker get — and how fast could we revoke them?
2 comparable · ★1
- 08CICD14controls
CI/CD Pipeline Security
Could an attacker who controls a pull request, a third-party action or a mutable tag run code in our pipeline with access to secrets or publishing rights?
1 comparable · 3 with no product
- 09SCM9controls
Source Control Security
Can any single person, token or app change a protected branch, a release tag or a workflow without independent review and an audit trail?
★2
- 10BUILD12controls
Build Integrity & Cryptographic Trust
For any artifact in production, can we cryptographically prove which commit, which build platform and which inputs produced it?
2 comparable · 1 with no product
- 11REGISTRY9controls
Package Registry & Provenance Security
Can anything reach a developer, build or production cluster that was not published by the expected pipeline and verified against its provenance?
1 with no product
- 12CONTAINER8controls
Container Security
Does every production image come from an approved minimal base, carry a signature and SBOM, and get rebuilt when its base is patched?
3 comparable
- 13IAC7controls
Infrastructure-as-Code Security
Is every infrastructure change reviewed against security policy as code before it is applied, and do we detect changes made outside of code?
- 14VALIDATE10controls
Runtime Application Validation
Do we test our running applications and exposed surfaces often enough to find what attackers would find first — and verify our fixes actually work?
- 15API7controls
API Security
Do we know every API we expose, and have we proven each one enforces object- and function-level authorization?
- 16K8S12controls
Runtime & Kubernetes Protection
Can only verified, policy-compliant workloads run in our clusters, and would we detect a container behaving like an attacker within minutes?
- 17CLOUD6controls
Cloud Security Posture
Do we know, right now, which cloud resources are exposed or over-privileged, which attack paths reach sensitive data, and who owns the fix?
- 18IAM8controls
Identity & Access Management
If one engineer's identity were phished today, what could the attacker reach — and would MFA, least privilege or detection stop them?
★2
- 19VENDOR7controls
Vendor Governance
For each supplier and integration with access to our code, pipeline or data, do we have current evidence of their security and a plan if they are compromised?
★1
- 20DR17controls
Detection & Response
If a dependency, action or maintainer account we rely on were compromised tonight, how quickly would we know, and have we rehearsed exactly what to do?
3 comparable · 4 with no product · ★1
- 21EVM12controls
Exposure & Vulnerability Management
Of all our open findings, do we know which few are actually exploitable in production, who owns each one, and whether last month's fixes really worked?
7 comparable · 1 with no product · ★1
- 22AI13controls
AI Model & Agent Security
Do we know every model, agent and AI tool in use, where each model came from, and what each agent is allowed to do without a human?
2 with no product
- 23ENDPOINT7controls
Endpoint Protection
Would we detect and stop an attacker executing code on a developer workstation or build server?
2 comparable
- 24DATA3controls
Data Protection
Do we know where our sensitive data is and who and what can access it?
- 25EMAIL2controls
Email & Collaboration Security
Would a targeted phishing email to a maintainer or engineer be blocked or detected?
★1
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 521 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.