Software supply chain compromises * Malicious cyber activity varies; the diagram below is one example of how cyber actors can exploit cyber supply chains to gain access to devices and systems. Actors often target software vendors to gain access to the software vendor's products or services. Actors use known security vulnerabilities to exploit and gain access to systems and accounts. Once a software vendor is compromised, actors can exploit the services or applications used by the provider’s customers. Customer Customer The malicious software or update is then provided to the vendor – which will be downloaded and installed by customers. Actors may replicate software, or inject malicious code into patches and software upgrades provided by the software vendor. 41