I am doing a survey of supply chain attacks, and I find it very annoying how 95% of the analysis is on payloads rather than compromise vectors.

I am doing a survey of supply chain attacks, and I find it very annoying how 95% of the analysis is on payloads rather than compromise vectors.

Yes, you are a very smart reverse engineer and you figured out a very clever payload. Yes, rolling out phishing-resistant auth is a slog. No, this is not how we make actual progress.

</rant>