With these kinds of attacks, an organization can be vulnerable even if its own cybersecurity defenses are rigorous. As organizations brace for potential software supply chain attacks in the future, they have to monitor the full software development lifecycle for points of vulnerability. Organizations need to identify whether there are risks in their own software development by “shifting left.” That is security testing and software composition analysis early in the software development process, thus the process of shifting to the “left” side of the DevOps lifecycle. But they also need to accept the risk that some vulnerabilities will make their way into live applications. As a result, they also need to “shift right” to explore runtime vulnerabilities in their production applications.