Commercial and third-party software, under-addressed by traditional AppSec tooling, is the principal attack surface for modern software supply chain compromises. Here's why -- and how your team can mitigate its risks.