Supply Chain Resiliency in a Connected World

Last week, I had the privilege of participating in the Supply Chain Cybersecurity panel organized by Embry-Riddle Aeronautical University (ERAU). The event highlighted the critical need for collaboration between government, industry, and academia to advance supply chain information management technologies. While these discussions are essential, the real excitement of being on such a panel comes from engaging with thought-provoking questions raised by my peers.

Defining the Supply Chain

The term "supply chain" is often overused and misunderstood. So, the definition of a supply chain was an excellent way to kick off our discussion. From my perspective, what sets supply chains apart in this context is their inter-organizational nature—multiple partners operate without a singular governing entity. Two key characteristics define this relationship:

1. Balancing Trust and Caution – Supply chain participants must simultaneously cooperate and compete, necessitating a "trust but verify" approach. This mirrors the Data-Centric Strategy advocated by the United States Department of Defense . What needs to be securely tracked are the objects—hardware components, software components, and information—being transferred from one organization to another, even when there is not 100% trust in the entities handling them along the way.
2. Different Standards Across Organizations – Expecting a universal standard across all supply chain participants is impractical. Each organization has its own way of handling cybersecurity practices, business operations, and information governance. These challenges are similar to we have seen in information exchange within any diverse consortium of organizations, from the Defense Research, Development, Evaluation and Test (RDT&E) Community to the NextGen Air Transportation System.

Supply Chain Resiliency as a Knowledge Management Problem

A key takeaway from the discussion is that supply chain resiliency is fundamentally a knowledge management problem. There is an old saying "when you have a hammer, everything looks like a nail." In today's world, it might be fair to say, "when you have Gen AI, every problem looks like a knowledge management problem". Supply chain is no exception. Organizations struggle to mitigate risks effectively when they lack shared visibility into the supply chain. Some of the biggest challenges and opportunities include:

• Sub-tier Supplier Visibility – The Defense Industrial Base (DIB) has an extensive supplier network. For example, aircraft manufacturers like Boeing and Airbus get their parts from thousands of suppliers across the globe. A lack of transparency at these lower tiers creates security vulnerabilities.
• Supplier Risk Assessment and Management – AI-powered risk scoring can assess supplier reliability and cybersecurity posture before onboarding.
• Visibility into Software Supply Chain – Best practices such as maintaining a Software Bill of Materials (SBOM) for avionics software ensure traceability and regulatory compliance. Implementing continuous static and dynamic security testing for commercial off-the-shelf (COTS) software is another crucial step toward mitigating cybersecurity risks.

Supply Chain Resiliency as a Zero Trust Problem

While SBOM provides transparency in component and software production—"keeping honest people honest"—ensuring that what is delivered matches what was built on the production line remains a challenge. This is where AI and Zero Trust Architecture can play a role:

• AI can compare software as designed (using large language models on design documents and source code) with software as deployed (recovering architecture from binary code to detect discrepancies).
• Zero Trust Data Format (ZTDF) ensures the integrity of data in transit, preventing tampering and unauthorized access.
• Similar techniques can be used to maintain the chain-of-custody for software and data products, providing assurance that data has not been altered or compromised.

More Questions Than Answers

The panel left us with more questions than definitive answers, but meaningful progress starts with asking the right questions. Several real-world initiatives illustrate how organizations are beginning to address supply chain cybersecurity challenges. For example, the FDA is developing a Product Tracing System to track food products from farm to table. Our team at NIRA INC is proud to contribute with a standards-compliant platform to manage supply chain transactions securely. Within the DOD, the Air Force Research Laboratory is exploring AI to analyze supply chain vulnerabilities and enhance security within the defense industrial base.

Final Thoughts

This discussion reinforced that supply chain security is not just a technical problem—it’s a strategic challenge. Protecting supply chains requires a balance of policy, technology, and industry collaboration. As organizations continue to explore AI, Zero Trust, and security-first approaches, these insights will shape the future of supply chain resilience.