Most security incidents map onto an existing budget line. This one does not. The compromise Upwind Security was first to report did not exploit a vulnerability, defeat a control, or breach a perimeter. It arrived through a supported feature of the package manager, executing exactly as designed, inside build systems most security organizations do not formally own. The Asset Nobody Signed Off On Ask a security team to enumerate third-party risk and the answer describes vendors. Contra...