Research from Sonatype and Forrester examines how AI is driving precision software supply chain attacks - and what this means for software governance, enterprise resilience, and responsible AI adoption across highly regulated industries.
HYDERABAD, India, July 29, 2026 -- Sonatype®, the company helping enterprises accelerate agentic software development with confidence, is bringing together technology, cybersecurity, and business leaders in India in association with Forrester to examine how artificial intelligence is reshaping software supply chain risk - and what enterprises must do to respond.
The discussion is informed by Sonatype's latest research, The Trust Economy of Software: How AI is Reshaping Software Supply Chain Risk for Financial Services. Based on an analysis of 9,747 verified malicious package advisories between January 2020 and May 2026, along with enterprise telemetry from the financial services sector, the study reveals a fundamental change in attacker behaviour.
Software supply chain attacks are no longer driven primarily by scale. Attackers are increasingly using precision campaigns designed to impersonate trusted software, target developers, and influence component-selection decisions before code reaches production. The implications are especially significant for India, one of the world's fastest-growing software development hubs and a global centre for financial technology, digital engineering, and Global Capability Centres. As Indian enterprises and GCCs expand their use of open-source software, third-party components, and AI-assisted development, the ability to govern what enters the software lifecycle is becoming a strategic business priority.
"AI is helping development teams assemble software faster, but it is also accelerating the number of decisions they make about what software to trust. Attackers understand that shift. They are no longer relying only on scale; they are investing in precision attacks that look familiar, targeting developers directly, and executing before traditional controls have a chance to intervene. For Indian enterprises and GCCs, the priority is not to slow AI adoption. It is to establish trusted governance at the point where software enters development," said Abhishek Chauhan, Senior Director of Technology and India Country Head, Sonatype.
Sonatype's research found:
- Targeted malicious package advisories increased 75-fold in two years, rising from 28 in 2023 to 1,576 in 2025.
- 47% of malicious packages now impersonate trusted software, using familiar names, integrations, and utilities to appear legitimate.
- 53% of malicious packages analysed in 2025 targeted developers during installation, before traditional security controls could intervene.
- More than one in four malicious package advisories now uses advanced techniques, including obfuscation, multi-stage droppers, and backdoors.
The findings highlight the need for enterprises to move beyond reactive vulnerability management by ensuring security begins before a component enters the build, not after it reaches production.
Speaking at the event was Ashutosh Sharma, VP, Principal Analyst, Forrester.
Software development is entering a new phase as AI changes not only how code is written, but also how software components are discovered, selected, and integrated. As organizations accelerate AI adoption, governance must evolve alongside development practices. Understanding how software trust is established and how software supply chain risks are changing will become increasingly important for organizations seeking to balance innovation with resilience.
For India's financial institutions, digital-native enterprises, and GCCs, the opportunity is clear: lead the next phase of AI-driven software development by governing software assembly with the same speed and discipline with which it is being created. As open-source and AI-assisted workflows become central to innovation, software confidence must move beyond compliance to become a source of competitive advantage - enabling faster delivery, stronger resilience, and more trustworthy AI adoption.
About Sonatype:
Sonatype is the company that accelerates agentic software development with confidence. Trusted by thousands of enterprises and millions of developers, Sonatype helps organizations govern the open-source, AI-generated, and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides unmatched visibility into how software is built, consumed, and secured - helping teams move faster, reduce risk, and ship software with confidence at AI scale. To learn more, visit www.sonatype.com
About Forrester:
Forrester (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We empower leaders in technology, customer experience, digital, marketing, sales, and product functions to be bold at work and accelerate growth through customer obsession. Our unique research and continuous guidance model help executives and their teams achieve their initiatives and outcomes faster and with confidence. To learn more, visit www.Forrester.com
View original content to download multimedia:https://www.prnewswire.com/in/news-releases/sonatype-and-forrester-address-the-growing-ai-era-software-supply-chain-risk-facing-indian-enterprises-in-the-guru-forum-302837277.html
