Hardware memory safety and automated supply-chain tracking reshape security strategy

Chris Swan, engineer at Atsign and security track host at QCon London, surveyed emerging consensus at the 2026 conference on how security engineering is fundamentally changing. The overarching theme: organizations must move away from relying on developer alertness and instead embed defenses directly into hardware, automation, and supply-chain processes.

Hardware memory safety gets a second wind#

One of the most promising near-term shifts involves catching memory errors before they become exploits. CHERI, a Cambridge-led research project, offers a pragmatic path forward by embedding memory-safety checks in processor hardware itself. This matters because the sheer scale of legacy code makes wholesale rewrites infeasible—there are roughly 5.5 billion lines of C and C++ versus only 70 million of Rust in open source today.

Rather than mandate a decade-long rewrite, CHERI-enabled processors can catch out-of-bounds errors and buffer overflows directly in silicon. Apple's latest iPhone chip and Google's Pixel flagship already incorporate cherry-picked CHERI-like features; broader adoption through RISC-V could democratize memory safety across entry-level and mid-range devices. The payoff: applications stay written in existing languages while gaining hardware-enforced protection.

Supply-chain visibility becomes mandatory#

The EU Cyber Resilience Act (CRA), now in force for breach reporting and taking full effect for software bill of materials (SBOMs) in December 2025, is forcing organizations to document and track dependencies systematically. This regulatory push echoes earlier work by researchers who noted that buyers (especially large government entities) naturally prefer software with transparent, vulnerability-free supply chains.

Building security into continuous delivery pipelines—generating SBOMs automatically, collecting SLSA attestations, running open source security scorecards—transforms security from an afterthought into a streamlined, auditable process. Organizations can now demonstrate they've chosen the right components, prepared software safely, and maintained rigorous standards throughout production.

The double-edged sword of AI in security#

LLMs and autonomous agents present both risk and opportunity. Attackers can use AI to accelerate vulnerability discovery and exploit generation; defenders face amplified exposure as non-human identities (agents, microservices) proliferate, demanding stricter, task-based permission controls.