The FinOps view: price both sides of supply-chain security.

Every other case study on this site dissects an attack. This one opens the ledger. IBM's 2026 breach report puts the average supply-chain compromise at $4.96 million and 258 days from intrusion to containment. One US cabinet department logged 33,000 person-hours responding to Log4j. SolarWinds booked $18 million of incident cost in a single quarter. Against that stands a prevention budget that, in most of the market, is priced per developer seat — scaling with the one variable that has nothing to do with the risk. Here is the arithmetic, and where it is honest to say the arithmetic stops.

For the budget conversation, three numbers travel well. $4.96M is what the average supply-chain breach costs (IBM, 2026). 258 days is how long it runs before it is contained — longer than any other attack vector in the report. And "business partner compromise" is the single largest cost amplifier IBM measured, adding about $227,000 on top of an average breach. Supply-chain incidents are not more frequent than other breaches. They are slower, wider, and dearer.

The incident bill

What the averages hide: the cost is mostly people.

Breach-cost headlines are dominated by regulatory fines and customer notification. Supply-chain incidents are different in shape: their cost lands in engineering time, because the remediation unit is not "a server" but "every artifact and every credential the poisoned package could reach". The Cyber Safety Review Board's Log4j report is the clearest public record of that. A single federal department reported 33,000 hours of response work — for its own networks alone. The Board noted that organisations "reallocate[d] significant resources in a short period", that the effort "delayed other mission-critical work", and that it produced burnout among defenders. None of those three lines appears on an invoice. All three are real cost.

The 2026 worm campaigns made the same point in a different currency. When ChainDrop harvested npm, GitHub, cloud and Vault tokens from every machine that ran a preinstall script, the remediation unit became "every secret a developer laptop could reach". Rotating one credential is minutes. Rotating every credential across every workstation and CI runner that touched one of 400 poisoned packages — and rebuilding from a known-good baseline first, as Microsoft's guidance demands — is weeks of senior engineering time that was scheduled for something else.

And the clock runs long. IBM's 258-day lifecycle for supply-chain breaches is not a measure of attacker patience; it is a measure of how hard it is to answer "which builds pulled the bad version, when, onto which machines?" without an authoritative record. SolarWinds' own disclosure — at least $18 million of incident expense in the first quarter of 2021 alone, before litigation — shows what that question costs when the answer has to be reconstructed after the fact.

$4.96M

average cost of a supply-chain compromise (IBM Cost of a Data Breach 2026)

258 days

to identify and contain — the slowest vector in the report

33,000 h

of Log4j response in one US department (Cyber Safety Review Board)

$18M

SolarWinds' incident expense in Q1 2021 alone, per its own filings

The prevention bill

Priced per seat, for a risk that scales per pull.

FinOps has one durable rule: tie spend to the unit that actually drives value or risk. Supply-chain exposure is driven by pulls — how many upstream versions resolve into your builds, how fast, from how many ecosystems. It is not driven by headcount. A five-person platform team serving three thousand developers has exactly the same exposure to a poisoned keyv release as the three thousand do; a contractor who joins for a quarter changes the seat count and changes the risk not at all.

Yet the market prices the controls that matter — scanning, curation, a hold on freshly published versions, a fleet-wide block on advisory-listed ones — as per-user add-ons on top of a per-server registry. The incentive that creates is the one FinOps teams know from cloud bills: the protection gets scoped to the teams that can justify the seat cost, and the rest of the organisation pulls from upstream directly. The ChainDrop and TanStack campaigns did not check who had a licence.

We built OrbitalReg's pricing the other way round, and we say so on the pricing comparison: the security layer is free permanently, for every developer and every runner, because the control has to be universal to work at all. Paid tiers are per deployment — never per user, never per gigabyte — so the bill tracks the number of registries you run, a number you control, rather than the size of your organisation, a number you want to grow.

The OrbitalReg defence — in euros

Where a curated registry moves the ledger.

✓Shorter containment, smaller bill

IBM's lifecycle number is a question-answering problem. The append-only pull log answers "which builds, which machines, which day" in one query — which turns a 258-day reconstruction into a scoped rotation list on day one. Containment time is the cost lever you control most directly.

✓Quarantine: cheapest insurance you'll buy

A hold on new upstream versions costs developer latency on legitimate patches — real, but small, and bypassable through a logged fast-track for advisory fixes. What it buys is the window in which a poisoned release gets yanked or flagged before it reaches you. Expected loss avoided against expected latency: the ratio is not close.

✓Universal by price, not by exception

Scanning, curation, quarantine and pull-gates at €0 remove the procurement step that otherwise decides which teams are protected. The control that must cover every pull to work cannot be the one that needs a per-seat business case.

✓The egress line nobody attributes

A proxy that serves 40+ formats from one cache also replaces thousands of redundant upstream pulls per day with one. For cloud-hosted CI that is a measurable bandwidth and build-minute reduction — a FinOps win that arrives as a side effect of the security architecture.

The honest caveat. Averages are not your number: IBM's $4.96M blends industries, regions and company sizes, and a twenty-person startup will not spend 33,000 hours on anything. The right way to use these figures is as an order of magnitude for the expected-loss side of a decision, not as a forecast. A quarantine window does have a cost — every hour of hold is an hour your developers wait for a legitimate patch — and a registry cannot un-steal a credential already harvested at hour zero. For small teams, the scarcest resource in an incident is not licence budget but attention, and no pricing model gives that back. What the registry changes is the shape of the decision: prevention becomes a fixed, per-deployment line you can defend once, and the incident bill becomes bounded by an audit trail instead of open-ended.

The ledger, side by side

Two columns a CFO can read in a minute.

If it happens — published figures

Average supply-chain breach (IBM 2026): $4.96M
Added by "partner compromise" factor: +$227K
Lifecycle to containment: 258 days
One department's Log4j response: 33,000 h
SolarWinds, Q1 2021 only: $18M
Scales with: pulls × secrets reached

Preventing it — OrbitalReg

Scanning, curation, quarantine, pull-gates: €0, permanently
Developers and CI runners covered: all of them
Commercial tier, three clusters, year one: €10,000
Per-user or per-gigabyte charges: none
Exposure list after an incident: one query
Scales with: deployments you run

Incident figures are industry averages and single disclosed cases, cited below; they illustrate magnitude, not your organisation's expected loss. OrbitalReg pricing as published on this site in October 2026.

Sources

Want the two-column version for your own numbers?

Put a per-deployment line where the per-seat one used to be.

Rico, the founder, walks through the ledger with your pull volumes, your formats and your current licence — and shows what the audit trail does to the containment clock.

See all supply-chain case studies