# Toby Van de Grift

Toby Van de Grift writes about software supply chain security, cybersecurity threats, and supplier risk, with a focus on how organizations can manage risks across their software and vendor networks.

- Profile: https://b2binfluencer.marketing/creators/toby-van-de-grift/
- LinkedIn: https://www.linkedin.com/in/tobyvandegrift
- LinkedIn followers: 9,521
- Topics: supply-chain, cybersecurity, software-supply-chain-security
- Based on 16 dated posts, latest 2026-09-21

## Summary

Toby Van de Grift is most useful for short LinkedIn posts framing software supply chain and supplier risk for business audiences.

- Best for: Best for a cybersecurity vendor commissioning thought leadership on software supply chain security.
- Not for: It does not fit account-based campaigns needing named job functions, contracted reach, rate card, or original long-form research.
- Check first: Confirm post-level reach, engagement, audience composition, and partnership terms before contacting them.

### Takeaways

- Supplier risk belongs in resilience planning, not only procurement.
- Supplier risk management and software assurance are two views of one dependency.
- Self-replicating malware changed the threat model, and credentials are the target.

## Main ideas

- **Software supply chain risk is a governance problem, not technical hygiene**: The argument repeated most often is that the security of the software an organisation runs is a board-level issue. Every enterprise depends on compiled binaries from vendors it did not write, yet procurement, risk and engineering tend to treat that dependency as separate concerns. Buyers inherit weaknesses suppliers fail to fix, shifting the board's question from whether the company can afford to invest in software supply chain security to whether it can afford to let suppliers skip it.
- **Suppliers should have to prove their software is safe to stay in the chain**: A related demand runs through the posts: enterprises should look beyond their own four walls and require upstream and downstream partners to demonstrate the security of what they ship. The format matters less than proof of security. The obstacle is cultural as well as technical: procurement, risk and engineering teams must agree that inherited weakness is theirs to manage.
- **Supplier risk management and software assurance are two views of one dependency**: Toby Van de Grift argues the two disciplines have long sat apart—one in procurement, the other in security or engineering—but now address the same problem. The formulation is concise: supplier risk management tells you who you depend on, and software supply chain security tells you what you depend on. Together, they move an organisation from compliance to confidence.
- **The Critical 7: a named working scope for the field**: One post gives the field a seven-item list called the Critical 7: malware; behaviours, tampering and diffs; vulnerabilities; hardening; secrets; licences; and bills of materials in their various forms—SBOM, SaaSBOM, MLBOM and CBOM. It presents the list as a working checklist rather than a formal definition, placing licences alongside the purely technical categories.
- **Self-replicating malware changed the threat model, and credentials are the target**: The Shai-hulud npm worm differs from a typical malicious package because it self-replicates: after compromising a developer account, it publishes poisoned versions of other packages, allowing one compromise to cascade into many downstream breaches. Credentials, tokens and secrets are the targets; stolen credentials are reused to publish more malware. The post recommends continuous dependency monitoring, protecting and rotating credentials, and responding quickly to suspicious package or account activity.
- **Regulation is why supplier risk cannot stay a procurement exercise**: In a post on attacks against household-name companies, the argument is that the affected organisations were not negligent but operated in deeply interdependent supply chains. It sets out the regulatory case: under GDPR, a controller remains responsible for personal data even when a breach starts with a processor; NIS2 requires third-party assurance to be demonstrable and continuous; and DORA requires ICT third-party risk to be monitored, tested and reported. The conditions it identifies are accountability without control and systemic dependency without systemic resilience.
- **Build and delivery infrastructure sits inside the scope, not outside it**: One post draws the field's boundaries explicitly. It reports that a misconfigured AWS system could have enabled what researchers described as one of the largest potential software supply chain attacks to date. The risk, it argues, lay in cloud-hosted build and delivery infrastructure—the systems that compile, sign and distribute software at scale—not in a single vulnerable package.

## Work to read

- [Supplier Risk Is Everyone's Problem: What JLR, M&S, and the Co-op teach us](https://www.linkedin.com/posts/tobyvandegrift_supplierrisk-tprm-cyberresilience-activity-7379403567629021184-Ct_B)
- [Software supply chain security as board-level risk](https://www.linkedin.com/posts/tobyvandegrift_softwaresupplychainsecurity-softwaresupplychain-activity-7379781052199874562-qwz8)
- [Beyond the Perimeter: Where SRM Meets Software Supply Chain Security](https://www.linkedin.com/posts/tobyvandegrift_reversinglabs-tprm-softwaresupplychainsecurity-activity-7385917831063744512-QQGI)
- [The Critical 7 of SSCS](https://www.linkedin.com/posts/tobyvandegrift_tprm-softwaresupplychainsecurity-activity-7377053093491838976-N39F)
- [Self-replicating Shai-hulud worm targets npm packages](https://www.linkedin.com/posts/tobyvandegrift_self-replicating-shai-hulud-worm-targets-activity-7374434121336672257-LkST)
- [Shai-hulud is a call to action on application security](https://www.linkedin.com/posts/tobyvandegrift_shai-hulud-is-a-call-to-action-on-application-activity-7417833048756502529-zE3z)
- [Misconfigured AWS system and cloud build pipelines](https://www.linkedin.com/posts/tobyvandegrift_misconfigured-aws-system-could-have-enabled-activity-7419646240692461568-w1PD)
- [EU software regulations webinar announcement](https://www.linkedin.com/posts/tobyvandegrift_register-eu-regulatory-compliance-sscs-activity-7315282346616737794-8YLr)

## Brand relationships

- **ReversingLabs** (disclosed_partnership)
- **DarkReading** (mention)

## Partnerships

Toby Van de Grift’s LinkedIn posts cover software supply-chain security, supplier risk and cybersecurity. They include vendor-related commentary and a ReversingLabs webinar promotion. Ask Toby about partnership formats and terms.

## Alternatives

- David Rajakovich: Choose David Rajakovich for a campaign needing quantified evidence on third-party breach trends or a direct challenge to standard TPRM questionnaires. The posts cite figures — a 2025 Verizon Data Breach Investigations Report figure that 30% of breaches involve a third party, a reported 431% rise in supply-chain attacks between 2021 and 2023, and a 179% year-on-year rise in weekly attacks in 2024 — and give a concrete supplier-check example using an SBOM, BuiltWith and a Vulnerability Exploitable eXchange document. They also answer a sceptical reader’s question head-on, making them a fit for thought leadership aimed at a doubting audience. A second post extends the same buyer task to AI-agent governance: a rogue agent that escalated its own permissions to clear a purchase, why that looks like normal activity, and why identity is the first place to look. Rajakovich is a stronger choice when the partnership needs a quantified trend piece plus an AI-governance follow-up.
- Bartosz Jurga: Choose Bartosz Jurga for a campaign needing pipeline-level attack mechanics with an executive frame. The posts explain a specific compromise — the keyv package and the ChainDrop campaign, with 400+ infected packages and 500M+ weekly downloads — and spell out what it means for a CEO, CISO or CTO: blast radius through CI/CD runners and deployment secrets, compliance exposure under NIS2 and ISO 27001, and business-continuity risk when a build pipeline is poisoned. The posts end with board-level questions, making them a fit for a partnership aimed at executives deciding whether to act. A second post adds a ransomware-payment decision, including the claim that over 50% of enterprise victims now refuse to pay and the argument that paying is an illusion of recovery, with immutable, air-gapped and tested backups as the answer. Jurga is a better choice when the campaign needs to connect software supply-chain risk to recovery and resilience rather than only to supplier assessment.
- Motti Sorani: Choose Motti Sorani for a campaign seeking an offensive-security origin story and a remediation-focused engineering message. One post recounts learning assembly language by reading computer viruses, then building a virus generator as an intellectual challenge — a first step into offensive security — in a conversation with co-founder Gil Regev. It offers strong material for a founder-voice interview or narrative-led thought leadership. The second post argues that security ROI has to be tangible: detection and visibility are only step one, engineers do not need more alerts, and the real problem is fixing vulnerabilities at scale without slowing development. A telecoms last-mile comparison makes the point. Sorani is a better choice when the partnership needs a remediation and developer-workflow angle, or a personal story to open a technical campaign.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/