Supply Chain and Updates

What it is

Modern UAS platforms are assembled from a mix of first-party and third-party software components, open-source libraries and hardware sub-components, all delivered and updated through a software supply chain.

Why it matters

A weakness introduced anywhere in that chain — a compromised dependency, an unverified update, an unexpected hardware substitution — can end up running with the same trust as first-party code, often without an obvious signal that anything changed.

Affected components

Third-party software components and libraries, hardware sub-components sourced from external vendors, and the update and deployment pipeline that delivers changes to fielded systems are all in scope.

Defender questions

Organizations should know whether they maintain an inventory of third-party components across their UAS software and hardware, whether their update pipeline is authenticated and auditable end to end, and whether an unexpected component or configuration change would actually be noticed.

Detection ideas

Comparing deployed configurations against a known-good baseline, monitoring update-pipeline activity for unauthorized changes, and tracking component provenance over time all help catch supply-chain issues before they reach production missions.

Mitigation themes

A maintained component inventory with provenance tracking, an authenticated and auditable update pipeline, and ongoing configuration and integrity monitoring form the practical foundation for supply-chain resilience.

Practice this in a mission

Supply Chain Surprise turns this topic into a hands-on investigation, tracing an unexpected behavior back to its source inside an isolated lab.