*AST scanners are not going away any time soon and are great at what they were designed to do – find vulnerabilities. For a software supply chain security programs to be effective you need to think about capabilities such as differential analysis, tampering, secrets compromise, and behavioral analysis of the software package.