Your software vendor was compromised: what do you do on day one?

On day one, find every instance of the vendor's software, isolate or restrict the affected ones, rotate credentials the software could reach, hunt for activity described in the vendor and government guidance, ask the vendor specific questions, and document everything. Do not wait for a full forensic picture before containing.

Step by step

1. Read the primary guidance. Use the vendor's notice and any national agency advisory. CISA's SolarWinds Orion advisory is an example: it categorised networks by evidence and gave actions per category, including disconnecting affected instances.
2. Inventory the software. Find every installation, version and the systems it connects to. Include test and forgotten deployments.
3. Classify exposure. Affected version installed, and was it online? Use evidence to place each instance into a category.
4. Contain. Isolate affected hosts, restrict outbound traffic and image them for forensics before rebuilding.
5. Rotate. Reset credentials stored in or used by the product. Where administrative or SAML credentials may be involved, CISA advises treating the identity trust store as potentially compromised.
6. Hunt. Look for the indicators the sources list, plus unusual logins and new accounts.
7. Ask the vendor. See the questions below.
8. Document. Decisions, times, owners and evidence.

Questions for the vendor

• Which versions and dates are affected, and how do we verify a clean build?
• Which credentials or data could the affected software access?
• What indicators should we hunt for?
• When is the next update, and who is our contact?
• Is there an independently reviewed root cause?

What not to do

• Update to the newest release without confirming it is clean.
• Announce externally before facts are confirmed and approved.
• Treat a valid signature as proof of a clean binary. The SolarWinds advisory states the malicious file was signed with the legitimate certificate.

Afterward

Review your dependency on the vendor: access granted, network position, logging, and how fast you can isolate it. Add a vendor compromise scenario to your tabletop exercise.

Try it yourself

Open the demo and see how monitoring links a new reported issue to the assets it affects, the same lookup you need on day one.

Click through it at your own pace, or open it full screen.

Keep a running timeline

Start a shared timeline in the first hour and add every decision with the time and the person. It helps your own team stay aligned, and it becomes the basis for customer questions, insurer notices and any later review. Note what you knew at each point, not what you learned later, so the record stays honest about uncertainty.

Quick check

Where Safeguard fits

Safeguard offers asset discovery, SBOM and dependency scanning, and continuous monitoring support for the inventory and scoping steps. Try the free scan.

Sources

• CISA AA20-352A, SolarWinds Orion compromise

Last reviewed: 19 October 2026.