# Government Contractors Strengthen Supply Chain Security

Recorded Future’s Insikt Group reported 215 actively exploited vulnerabilities in the first half of 2026, a 34% increase year over year; exploitation was detected an average of 564 days after vulnerabilities were disclosed. Although the report identifies no specific government procurement or agency action, the findings highlight supply-chain and software security risks relevant to contractors that rely on third-party software, suppliers, and developer environments.

- Contractors should prioritize vulnerabilities known to be actively exploited and strengthen oversight of third parties and software dependencies, as recommended in the signal.
- Procurement and security teams can use these findings when evaluating supplier security practices, including credential management, exposure management, and protections for developer environments.
- The reported delay between disclosure and detected exploitation underscores the value of assessing vendors’ ability to identify and triage actively exploited vulnerabilities rather than relying on disclosure dates alone.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 21, 2026

### Key Quotes
> Alert volume will continue to be a challenge for security teams. The solution will be in knowing which vulnerabilities threat actors are actually using. Being able to identify and triage them at AI speed is what will separate teams that get ahead of exploitation from the ones reading about it after the fact.
> — Dan Elliott, Field CISO, APJ, Recorded Future

### Sources
- [Supply chain attacks rise as 215 flaws are exploited](https://securitybrief.asia/story/supply-chain-attacks-rise-as-215-flaws-are-exploited) - SecurityBrief Asia