It's well understood that the technology supply chain introduces risk, but until recently, the focus has been on people and processes, leaving the technology itself as a major visibility gap. To effectively manage supply chain risk, government organizations must understand and address the full scope of the supply chain. As recent attacks have demonstrated, that extends to the software and update process as well. When considering supply chain risk, an attack during product transport can cause irreparable harm. However, physically tampering with hardware is not scalable. Manipulating the software inside hardware (firmware), on the other hand, very much is. In the Sunburst campaign, attackers delivered a malicious backdoor to over 18,000 SolarWinds customers by compromising the authorized software update infrastructure. This is similar to the previous ShadowHammer attack, where compromised ASUS update servers were used to push malware to hundreds of thousands of customers. In both cases, the updates were properly signed and appeared valid.