I talk about software supply chain security in different capacities, and I often get the same question: "If we can only do a few things, what should we do first?" This is why I compiled a list of five immediate controls that a technical leader can implement rather quickly, perhaps in a few hours: i. Isolate local AI agents. ii. Freeze unvetted dependencies and disable lifecycle scripts. iii. Use a hardened multi-stage container build. iv. Generate an SBOM and maximum-level provenance ...