It may take decade to shore up software supply chain security, says infosec CEO