The Rising Cost of Trust: Practitioners' Trust Signals, Controls, and Responses in the Software Supply Chain

2026-08-20

AI Summary

研究通过采访38位从业者，探讨了软件供应链中信任信号、控制措施及应对策略，揭示了随着AI改变威胁格局，信任成本上升的问题，并提出自动化验证等解决方案。

Abstract

The software supply chain is becoming more complex, and AI is reshaping its threat landscape, e.g., raising concerns about the quality of AI-generated dependencies. Seen through the lens of trust, the stakes of eroding trust in the software supply chain are high, yet we lack an empirical baseline on practitioners' trust. The goal of this study is to aid software practitioners in taking informed actions as trust in the software supply chain evolves, through an interview study with 38 practitioners. We conducted semi-structured interviews with industry and open-source practitioners, focusing on their revealed preferences (the controls they adopted) rather than their stated attitudes, and analyzed the data using thematic analysis grounded in established trust concepts from the social sciences. We find that trust is eroding, which is becoming costly: aware practitioners are accumulating controls. To cope with the rising cost of trust, practitioners automate verification, delegate trust decisions to guardians, or consider exiting the software supply chain entirely. Understanding software supply chain dynamics through the lens of trust provides the vocabulary and concepts (e.g., guardians of trust, system trust, signals) to shape future interventions for a well-functioning supply chain with appropriate levels of trust.

Problem

• software supply chain
• trust
• AI-generated dependencies

Innovation

• trust erosion
• automation verification
• guardians of trust