Securing the Software Supply Chain with Justin Cappos

Modern software is built on layers and layers of code. So how do we know we can trust it? In this episode of Alexa’s Input (AI), Alexa Griffith sits down with Justin Cappos, professor of computer science at NYU and a leading expert in software supply chain security, to unpack what trust really means in today’s digital infrastructure. From package managers and dependency chains to large-scale outages and AI systems built on inherited code, Justin explains why many security failures aren’t random accidents, they’re predictable consequences of weak process, misaligned incentives, and insecure design. They discuss: Why security only becomes visible when something breaks The difference between unavoidable failure and negligence How modern software supply chains amplify small mistakes The role of leadership and culture in preventing breaches Why verification systems like TUF and in-toto matter more than ever As AI accelerates development and increases system complexity, the need for verifiable trust only grows. This episode is a practical look at the invisible infrastructure that keeps modern software, and increasingly, modern AI, from collapsing under its own complexity. Podcast Links Watch: ⁠⁠⁠⁠⁠⁠https://www.youtube.com/@alexasinput⁠⁠⁠⁠⁠⁠ Read: ⁠⁠⁠⁠⁠⁠⁠⁠https://alexasinput.substack.com/⁠⁠⁠⁠⁠⁠⁠⁠ Listen:⁠⁠⁠⁠ https://creators.spotify.com/pod/profile/alexagriffith/⁠⁠⁠⁠ More: ⁠⁠⁠⁠⁠⁠https://linktr.ee/alexagriffith⁠⁠⁠⁠⁠⁠ Website: ⁠⁠⁠⁠⁠⁠https://alexagriffith.com/⁠⁠⁠⁠⁠⁠ LinkedIn: ⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/alexa-griffith/⁠⁠⁠⁠⁠ Find out more about the guest at: Website: https://engineering.nyu.edu/faculty/justin-cappos NYU page: https://ssl.engineering.nyu.edu/personalpages/jcappos/ Wikipedia: https://en.wikipedia.org/wiki/Justin_Cappos Chapters 00:00 Introduction to Justin Cappos and His Work 01:17 The Importance of Security in Software Systems 03:50 Understanding Security Breaches: Mistakes vs. System Design Problems 06:34 Cultural Factors in Security Failures 09:25 Justin's Journey in Software Security 12:03 The Role of Academia in Enterprise Security 14:10 Evaluating Enterprise Security Systems 16:58 Foundational Projects in Software Security 19:21 AI Security Concerns and Future Directions 24:59 The Need for MCP 2.0 28:57 Security Challenges with LLMs 32:33 Designing Secure AI Systems 37:14 Ethical Dilemmas in AI Decision-Making 40:17 The Role of AI in Open Source 43:44 Trust and Mindset in AI Security