Software supply chain risk
The Cost of a Compromised Update
A compromised update can cost money for years after a company removes it. SolarWinds reported insurance payments for its 2020 cyberattack four years later.
50 million dollars
Insurance payments to SolarWinds in 2022 and 2023, in US dollars.
Payments recorded in the annual report
SolarWinds reported these insurance payments for costs from its 2020 cyberattack:
- 2022
- $30.202 million
- 2023
- $19.798 million
The $50 million covers payments to SolarWinds alone. It does not include losses at its customers. It is not the total cost of the attack.
Source: SolarWinds 2024 annual report, Note 15, “Cyber Incident.”
See what an update can do before it spreads on your computers.
Your team builds software with AI tools, and those tools add packages all day. A power is something a file can do, such as reach the internet or run a program. Vigilance checks each new package version on our service and finds the update that newly gains a harmful power.
You do two things. Start the free 14-day trial. Then install Vigilance on each computer where your team vibe codes.
On a paid plan, Vigilance swaps the bad update for the last safe version. Nobody approves each swap. It holds unsure findings and reports them.
From the npm investigation
An update that added encoded PowerShell
Version 1.5.122 of @apexacc/cli added an encoded PowerShell command. That command asks for administrator rights.
The advisory records the change and the evidence behind it. Vigilance found the release eleven hours after it went to npm.
See every outside package on your computers.
Vigilance lists each outside package that lands on your people's computers. You see what your team runs and which updates it swapped.
Use that list when you explain your update review to customers, auditors or insurers.
Check your next update.
Vigilance watches the packages that AI tools and your staff add to each computer. On a paid plan it swaps a bad update for the last safe version.