Sunday, September 6th, 2026
Explainer
CrowdStrike has started intercepting npm install and pip install at the endpoint, blocking a package before its embedded scripts can run. That the defence has moved to the last moment before execution is an admission about everything upstream of it.
Procurement has learned to ask what open-source components a vendor ships. It still rarely asks what is running on the controller beneath the operating system, where the code is older, the provenance is thinner and the update path frequently does not exist.
Incident communication began as courtesy and has become evidence. The wording of a status update now determines credits, contract remedies and whether anyone believes the next one.
Engineering organisations are building the same abstraction over the same infrastructure, independently, because the alternative is asking every team to learn all of it.
Authentication requirements that were optional for years are enforced, and organisations that never thought about their sending domain are discovering their mail has quietly stopped arriving.
Industrial equipment outlives its control software by decades. Patching it means stopping production, and the vendor that wrote it may no longer exist.
Companies used to satisfy data residency with a paragraph and a regional bucket. The requirements have grown teeth, and satisfying them is now a question about how the software is built.
Work moved into the browser years ago and the security stack did not follow. Enterprises are now treating the tab, rather than the device or the network, as the place controls belong.
Software companies spent a decade giving away a usable product to build a funnel. The economics of that giveaway changed when the marginal cost of a free user stopped rounding to zero.
Companies have always known their software sits on components maintained by volunteers. Insurers, auditors and regulators are now asking which ones, who maintains them, and what happens when that person stops.
Logging, metrics and tracing bills have grown faster than the infrastructure they monitor. Engineering teams are discovering that the instrumentation is now a line item that needs its own budget review.
Companies that ignored security consultants for years are now doing exactly what their insurance carriers demand, because the alternative is being uninsurable.
A decade of frictionless departmental purchasing produced portfolios nobody inventoried. The consolidation now underway is being run by procurement, not engineering.
