Supply Chain Security Has the Operating Model Backwards

TL;DR Supply chain security usually treats runtime as the final stage, the place where teams find out whether earlier controls worked. Unfortunately, this operating model is backwards. This is not an argument to scan less or to wait until production to secure software.