<p>The group direct-relation matrix <i>Z.</i></p>

In recent years, the Software Supply Chain (SSC) has become a key target for cyberattacks due to its complex structure and dependence on third-party and open-source components. These attacks pose serious risks to the integrity and security of software systems. While many studies have explored solutions to specific security issues in the SSC, the relationships among the barriers to achieving robust security have not been comprehensively analyzed—particularly in the context of SSC security challenges using the Decision-Making Trial and Evaluation Laboratory (DEMATEL) technique. This study addresses this gap by identifying and analyzing the major challenges that weaken SSC security. To do this, the DEMATEL method was used to explore how different security challenges affect each other. Ten key challenges were identified based on a detailed literature review. The findings indicated that the three most significant challenges are insecure software distribution mechanisms, inadequate continuous monitoring and incident response capabilities, and the growing complexity and diversity of cyber-attacks. By visualizing the relationships between these challenges, this study clarifies where to focus security efforts. Solving root causes can lead to broader improvements across the entire software supply chain. The findings offer practical insights for decision-makers seeking to improve cybersecurity strategies in software development environments.近年来，软件供应链（Software Supply Chain, SSC）因其复杂的架构以及对第三方与开源组件的依赖，已成为网络攻击的核心目标。此类攻击会对软件系统的完整性与安全性造成严重威胁。尽管已有诸多研究针对软件供应链中的特定安全问题探索了解决方案，但针对实现稳健安全所需克服的各类障碍间的关联关系，尚未得到全面分析——尤其是在运用决策试验与评价实验室（Decision-Making Trial and Evaluation Laboratory, DEMATEL）技术开展软件供应链安全挑战研究的场景下。本研究针对这一研究空白，对削弱软件供应链安全的核心挑战展开识别与分析。为此，本研究采用DEMATEL方法，探究不同安全挑战间的相互影响关系。研究通过详尽的文献综述，共识别出10项关键安全挑战。研究结果显示，最为突出的三项挑战分别为：不安全的软件分发机制、持续监控与事件响应能力不足，以及网络攻击日益复杂且多样化。通过可视化呈现这些挑战间的关联关系，本研究明确了安全防护工作的重点方向。从根源层面解决问题，可推动整个软件供应链的整体安全水平得到全面提升。本研究结果可为寻求优化软件开发环境中网络安全策略的决策者提供切实可行的参考依据。