Supply chain attacks do not begin at the front door. They slip in through a trusted partner, a software update, a shared library, or a service provider that already has a place in the environment. That is what makes supply chain attacks so effective: the request, file, or login often looks normal.