Supply chain attack surface

ManySignal integrates with your SBOM (Software Bill of Materials) and monitors package registries (npm, PyPI, RubyGems, Maven) for malicious version publications, typosquatting, and maintainer account takeovers. When a package in your dependency tree is flagged, ManySignal identifies all services and repositories consuming that version and fires an alert with remediation guidance.

Yes. ManySignal's eBPF sensor monitors runtime behavior of all processes, including vendor software. Behavioral anomalies — unexpected network connections, file system access outside normal scope, process injection attempts — are detected regardless of the binary's reputation. This catches 'trusted binary, malicious behavior' scenarios like the SolarWinds and 3CX supply chain attacks.

ManySignal monitors outbound API calls from your environment and maintains a catalog of authorized third-party integrations. Calls to unauthorized endpoints, changes in data payloads sent to third-party APIs, and anomalous call volumes are flagged. When a third-party API endpoint's IP resolves to a known malicious range, ManySignal alerts immediately.

Yes. ManySignal integrates with Sigstore, SLSA framework attestations, Grype, Syft, and Snyk for supply chain security context. When a deployment includes artifacts without valid attestation or with known vulnerabilities in their SBOM, ManySignal adds this context to any runtime alerts from that workload.

When a dependency in your SBOM is flagged as compromised, ManySignal immediately cross-references all running services and build pipelines consuming that package. The response workflow identifies which production workloads are exposed, generates containment recommendations (network isolation for affected services, rollback to known-good package version), and escalates to the engineering on-call with the full impact scope already assembled. The blast-radius view shows how many downstream services depend on the affected package.

Yes. Code signing certificate usage events are monitored for anomalies: signing performed on systems that don't normally run signing operations, signing at unusual hours, certificates being used to sign packages not matching their declared scope, and certificate revocation events. Signing key compromise — a high-impact supply chain attack vector — triggers an immediate high-severity case with guidance on re-signing affected artifacts.

Supply chain risk findings are prioritized by blast radius: how many production services and what data do they have access to. A compromised dependency in a background analytics service is scored lower than the same compromise in a service with access to customer payment data. The blast-radius model uses the entity graph to trace downstream data access from each affected workload, enabling data-driven remediation prioritisation.

SBOM integration and dependency monitoring begin within 24–48 hours of connecting build pipeline and registry sources. Runtime monitoring via eBPF sensors requires DaemonSet deployment to Kubernetes nodes, which takes 2–4 hours in most environments. Full coverage — SBOM monitoring, runtime behavioral detection, and registry event alerts — is typically active within the first week of deployment.