Source: Docker (Mark Lechner, Docker CISO) — 2026-08-04
Summary
A Docker-sponsored Omdia survey fielded in February 2026 found that 77% of organizations experienced a software supply-chain security incident in the prior 12 months, and 38% of attacks exploited known vulnerabilities in third-party software. AI technology itself was ranked the top supply-chain risk, cited by 40% of respondents, while third-party code's share of the average codebase is projected to jump from 38% today to 58% within 12 months. Despite that rising exposure, only 51% of organizations rate secure containers as "very effective" as a mitigation, pointing to a gap between the scale of the risk and confidence in current defenses.
Key Takeaways
- 77% of surveyed organizations reported a supply-chain security incident in the previous 12 months — a majority-of-respondents statistic, not an edge case.
- 38% of attacks specifically exploited already-known vulnerabilities in third-party software — meaning patches or fixes likely existed but weren't applied in time.
- AI technology was ranked the #1 supply-chain risk overall, named by 40% of respondents — ahead of other named risk categories in the survey.
- Third-party code's share of the average codebase is projected to rise from 38% to 58% within just 12 months, a trajectory that concentrates more of an organization's attack surface in code it didn't write and doesn't fully control.
- Only 51% of organizations rate secure containers as "very effective" as a mitigation — roughly half, despite containers being a widely deployed control, suggesting confidence hasn't kept pace with adoption.
- The survey was fielded in February 2026, giving Docker and Omdia a fairly current read on practitioner sentiment rather than a lagging annual snapshot.
Reel Script
Hook: Three out of four companies got hit by a supply-chain attack in the last year. Not a phishing email, not ransomware on an endpoint — an attack that came in through a dependency, a container image, or a package they trusted. And the number of dependencies is about to get a lot bigger.
Core Concept: A software supply-chain attack isn't about breaking into your servers directly — it's about compromising something upstream that you build on top of: an open-source library, a base container image, a CI/CD tool, anything you pull in rather than write yourself. The Omdia survey, sponsored by Docker and fielded across security practitioners in February 2026, quantifies just how common that's become: 77% of organizations had an incident in the last year, and more than a third of all attacks — 38% — used vulnerabilities that were already known, meaning a fix existed somewhere but hadn't been applied before an attacker used it. The reason this trend is accelerating rather than leveling off is compositional: third-party code already makes up 38% of the average codebase, and respondents expect that to climb to 58% within a single year. That's not a small drift — it means within twelve months, most of what runs in production at a typical company will be code the company itself never wrote, reviewed line-by-line, or fully controls the update cycle for.
Hands-On: The chart worth sketching is a simple two-point trajectory: 38% third-party code today, rising to a projected 58% twelve months from now — draw that as a line climbing past the halfway mark of the codebase, because that's the real story, not just a percentage tick. Put it next to the risk-ranking finding: when respondents were asked to name their top supply-chain risk, AI technology itself topped the list at 40% — ahead of any other named category — which lines up with the trajectory, since AI coding agents are one of the main forces pulling in more third-party dependencies faster than review cycles can keep up. Then add the mitigation-confidence gap as a third data point: even though secure containers are a widely deployed control specifically meant to address this class of risk, only 51% of organizations call them "very effective." That's barely half, on a control that's been standard practice for years — a sign that adoption of a defense and trust in that defense are two separate curves, and the second one is lagging.
Takeaway: The math here is blunt: if third-party code goes from 38% to 58% of your codebase in a year and only half your org trusts its main container-level defense, the gap between exposure and confidence is widening, not closing. If your team hasn't re-evaluated its container hardening posture since before this survey was fielded, that's the concrete next step.