The gap between confidence and readiness is the difference between what a team believes about its supply chain defenses and what it can prove in a drill. You close it by replacing opinions with timed tests: find every use of a component, rotate secrets, and verify an artifact.
Why do survey answers and drills disagree?
Surveys ask people how they feel. Drills ask them to do something. A leader may say "we have SBOMs" because a tool generates them, while nobody has tried to answer a real question with one. Confidence comes from having a control. Readiness comes from having used it under pressure.
This post does not rely on any particular survey's figures. Instead it gives you tests you can run this month. The NIST SSDF frames secure development as outcomes to achieve, and outcomes can be tested.
What are the six readiness tests?
1. The "where is it" test. Pick a widely used library. Time how long it takes to list every product and version that contains it, including transitive use. The 2026 SBOM minimum elements say an SBOM should cover all components including transitive dependencies, so the recipient can conclude a new vulnerability does not apply if the component is absent. Can you reach that conclusion in minutes?
2. The secrets test. Assume a CI token leaked an hour ago. How long to list everything it could reach and rotate it? The Hugging Face Spaces disclosure shows the real pattern: unauthorized access, then revoking tokens and asking users to refresh keys.
3. The provenance test. Pick a container image from production. Can you show where and how it was built? SLSA defines provenance as what built the artifact, by what process and from which inputs.
4. The update test. When a vendor ships an update, who can hold it back? The July 2024 outage showed what happens when a content update reaches every host at once.
5. The exploitability test. Of your open findings, how many are known exploited? The CISA KEV catalog is the quickest filter.
6. The unknowns test. What do you not know? Count the repositories without an inventory.
What does a gap look like?
Constructed example: a security lead rates the team 8 out of 10 for supply chain readiness. A drill asks for every service using one logging library. Two teams answer in an hour. Five take two days. Three have no SBOM at all. The score that the drill implies is lower than 8, and more usefully, the drill names the three teams to fix first.
How do you score the drills?
Keep it simple. For each test, record the time to a complete answer and whether the answer was right. Mark a drill as passed only if a person other than the one who built the control can run it. A control that only its author can operate is a single point of failure, not readiness.
Then write down the slowest step in each drill. In the logging library example it is usually not the search. It is finding the owner of a repository, or learning that nobody owns it. Ownership gaps show up in drills long before they show up in audits, and they are cheap to fix once you can name them.
What to do
- Run tests 1 to 3 this quarter, with a timer and a written result.
- Record the time for each, and who had to be asked.
- Fix the slowest answer first, not the most visible gap.
- Repeat the same drills after changes, so you see movement.
- Report drill times to leadership beside survey sentiment.
Safeguard provides SBOM and dependency scanning, reachability analysis and policies and gates, which cover tests 1 and 5 for the code you scan. Drills 2 to 4 depend on your process.
What do you do with the results?
Share them plainly. A table with each drill, the time taken, the owner and the fix is enough. Resist the urge to turn it into a single score, because a single number hides which control failed. Leaders can act on "we cannot rotate CI secrets in under a day" far more easily than on "readiness is 62 percent". Re-run the failed drills after each fix, and keep the old results so progress is visible over several quarters.
Quick check
Is a high confidence score bad?
No. It is only unproven. Confidence backed by timed drills is useful. Confidence alone is a guess.
How often should we run these drills?
Quarterly is a workable start, and after any major tooling or team change.
Sources
- NIST SP 800-218, Secure Software Development Framework
- CISA, 2026 Minimum Elements for a Software Bill of Materials (SBOM)
- Hugging Face, Space secrets security update (31 May 2024)
- SLSA specification v1.0: levels and tracks
- CISA Known Exploited Vulnerabilities Catalog
Last reviewed: 18 October 2026.
