Zero CVEs: One Risk Graph for Suppliers, Hardware and Code
Between June 2024 and June 2026, fifty-nine documented campaigns pushed 657 malicious packages into npm and PyPI. Not one carried a CVE while it was being exploited. The Shai-Hulud worm family converted single stolen maintainer tokens into 1,092 backdoored versions across 796 packages with 130 million monthly downloads, with no human action between hops. Almost a quarter of these campaigns targeted AI developer tooling: poisoned MCP server definitions, zero-width Unicode instructions buried in agent configuration files, and agent skills that scan at more than twice the risk rate of IDE extensions. Signed provenance did not help; SLSA attestation forgery was demonstrated in a live breach.
This is a detection problem, but it is first a scoping problem. Nearly every supply chain control deployed today is keyed to the CVE: software composition analysis, vulnerability management, and the supplier questionnaire asking how quickly critical vulnerabilities get patched. Against these campaigns that stack was blind by design, not by neglect.
Organizations compound the failure by running supply chain risk as three unconnected programs:
- supplier assurance,
- hardware provenance from fabrication through assembly, warehousing and delivery,
- software composition. T
Three artefacts, three owners, no shared risk object. None of them answers the only question that matters during an incident. Which supplier compromise reaches my production runtime, through which component, on which hardware?
My session will show how AI can contribute—not as another scanner, but as a correlation engine. I will examine the campaign data, highlight behavioral signals that were visible while CVE feeds remained silent, and demonstrate a working prototype that combines SBOMs, hardware custody records, and supplier telemetry in a single, queryable risk graph. The prototype answers blast-radius questions in seconds rather than weeks.
This session’s attendees will leave with the detection signals, the graph schema, and an honest account of where the approach fails, so that other safeguards can be employed.
Pradeep Sekar – Vobis ARC
Pradeep Sekar is a seasoned cyber security leader who has worked closely with and guided Fortune 100 and Fortune 500 Chief Information Security Officers (CISO), Chief Information Officers (CIO) and their teams across various industries on developing and sustaining a secure, adaptive and robust cyber security program. His unique expertise includes the delivery of innovative cyber strategy solutions and benchmarking insights for global organizations as they look to transform their cyber programs.
He is currently the Advisory Services India Leader and Innovation Leader with Vobis ARC (formerly called Optiv Consulting) where he leads the Advisory Services. He leads the development and delivery of Optiv’s services in the domains of Artificial Intelligence, Strategy & Risk Management, Data Security, Application Security and Threat Management.
He is a member of the Economic Times India Leadership Council, which is an exclusive peer group forum of Heads of Businesses from Corporations representing all Indian industries and aims to work towards the end goal of transforming India’s business ecosystem through deliberations and candid exchange of ideas, setting macro agenda for scaling up businesses and driving change that would have a positive impact on business and the overall economy.
He has published thought leadership around security governance, threat profile and risk assessments in industry publications such as ISACA journal as well as on Optiv website (www.optiv.com). He has presented at the IIA/ISACA 9th Annual Hacker conference in Chicago, US; COSAC 2023, COSAC 2024 and COSAC 2026 Conference in Dublin, Ireland; Cloud Security Alliance Bangalore summit, ISACA Annual Karnataka conference in Bangalore, India; and ISC2 Bangalore chapter conferences.