In this special bonus episode, Adrian and Alexandre are joined by John Hammond, one of cybersecurity’s most recognizable YouTube creators and Senior Principal Security Researcher at Huntress - a cybersecurity company dedicated to protecting businesses of all sizes against modern-day cybercrime - for a deep dive into software supply chain attacks using the recent Axios NPM compromise as a case study. It's a timely conversation: supply chain incidents have gone from occasional headlines to a near-constant drumbeat, and the Axios case offers an unusually clear window into how these attacks actually work end-to-end.

- The discussion tackles the viral "stop updating your software" take head-on, with John arguing the real answer is nuance - keep patching Windows and Chrome, but treat CI/CD dependencies very differently. Adrian lays out his case for splitting vulnerability management into two distinct processes: traditional scan-driven work for compliance, and a separate intelligence-driven "VulnOps" function that operates more like incident response.

- The group also walks through the remarkable social engineering campaign that compromised the Axios maintainer — a patient, weeks-long con involving a fake Slack workspace, rescheduled Teams meetings, and a click-fix payload disguised as an audio troubleshooting step. One striking data point from John: the malicious package detonated 89 seconds after hitting NPM.

- The back half turns practical, with a concrete checklist for third-party risk teams and internal dev orgs: pin dependency versions, cache artifacts locally (which saved Tenchi during the Trivy incident, when attackers modified previously released binaries), enforce age-based release gates, separate CI from CD, apply least privilege to pipeline credentials, and maintain an asset inventory that can answer "do we have this package?" in seconds. John closes with homework for listeners: look up the Clean Source Principle.

In this April 2026 episode of Alice in Supply Chains, Adrian and Alexandre cover three stories that weren't on anyone's 2026 bingo card — and all of which land on the TPRM analyst's desk.

• AI in your third parties. Amazon's recent downtime, linked to engineers being mandated to use AI on production systems, raises a question most TPRM programs aren't equipped to answer: do you even know which of your vendors are using AI, which models, and how much agency those models have over customer data? Alexandre walks through AWS's generative and agentic AI scoping matrix — from no-agency to full autonomy — as a useful framework for architectural follow-up conversations. The pair also push back on Anthropic's "Mythos" vulnerability research claims, arguing the economics don't hold up against cheaper models, or against the real bottleneck: remediation, not discovery.

‍

• The FCC's ban on non-US routers. Adrian and Alexandre argue this is a thinly veiled economic measure dressed up as security policy. If this were really about backdoors, the US would mandate minimum security controls (as it does for medical devices and aviation) rather than country-of-origin rules. Netgear's mysterious exemption, the Salt Typhoon breaches that needed no backdoors, and the collapsed consumer labeling program all get airtime.

‍

• Is your third party a military target? Two AWS regions in Bahrain and the UAE were damaged during the Iran conflict, with one data center indefinitely down. Separately, a pro-Iran group compromised Stryker's Intune tenant and issued wipe commands across managed devices — including employees' BYOD phones. The takeaway: centralized management tools (Intune, MDM, patch management, AD) are high-value targets that TPRM questionnaires rarely probe deeply enough, and kinetic ceasefires don't extend to cyberspace.

‍

Links:

https://www.tenchisecurity.com/en/insights-news/cisa-says-harden-intune-heres-what-that-means-for-your-third-party

https://aws.amazon.com/pt/ai/security/agentic-ai-scoping-matrix/

https://aws.amazon.com/pt/ai/security/generative-ai-scoping-matrix/

https://www.defendersinitiative.com/p/from-this-point-on-it-only-gets-rougher

https://arstechnica.com/tech-policy/2026/04/fcc-exempts-netgear-from-ban-on-foreign-routers-doesnt-explain-why/

https://www.scworld.com/podcast-episode/2673-esw-310-shamim-naqvi-grace-burkard

Recorded April 1, 2026 — post-RSA 2026 edition
Hosts Adrian Sanabria (The Defenders Initiative) and Alexandre Sieira (CTO and Cofounder, Tenchi Security) reconvene — both recovering from the notorious con crud — to dig into the biggest stories from a packed month in third-party and supply chain security.
This month, we have two main stories:

• The ongoing Delve controversy and data leaks
• Our RSAC Conference 2026 takeaways

1. Alex’s ESW Appearance securityweekly.com/esw452
2. The episode we did with AJ Yawn on issues with SOC 2 reports https://www.tenchisecurity.com/en/alice-in-supply-chains/episode-7-hoxz2
3. Tony Martin-Vegue’s excellent “acting rationally, given the incentives” take on the Delve scandal https://www.linkedin.com/posts/tonymartinvegue_i-know-youre-tired-of-the-delve-discourse-activity-7441294170406891520-UtGg
4. Adrian’s blog with his RSAC Conference 2026 takeaways https://www.defendersinitiative.com/p/i-watched-all-11-main-stage-keynotes
5. Alex Sieira’s RSAC talk with Alex Pinto (login required to watch the recording) https://path.rsaconference.com/flow/rsac/us26/FullAgenda/page/catalog/session/1755192044047001WRoa
6. Adrian Sanabria and Adam Shostack’s talk on Breach Transparency from RSAC https://path.rsaconference.com/flow/rsac/us26/FullAgenda/page/catalog/session/1756101254392001bKZA
7. Tenchi’s ‘near miss’ report https://www.tenchisecurity.com/en/insights-news/secure-practices-trivy-supply-chain-attack