Evidence latency is the one number here you can time with a calendar. A control either has an artifact sitting next to it or it does not, and the interval between the request and the proof arriving is measurable. JFrog puts that interval above one week for 48% of the organizations it surveyed [2], drawn from a population where 59% said they had full provenance visibility into their software supply chains [1]. The same respondents gave both answers.
The denominator is what stops either figure from being quotable to the decimal. JFrog's post gives no sample size, no fielding dates, and no statement of whether the 48% is a subset of the 59% or the full respondent pool [12]. If it is a subset, the week-plus group is roughly 28% of all respondents rather than 48% (0.48 x 0.59 = 0.283) [13]. Both readings point the same way, and neither would survive an argument in front of an auditor; the figures were published by JFrog inside its own product announcement [16].
The CRA claim carries the stakes and the thinnest sourcing. JFrog dates enforcement to this September [4] and says the regulation is the first to write personal liability for security leaders into its text [5]. The post does not say which of the CRA's obligations begin in September, and it does not cite the article that creates the liability [15]. That sentence is worth checking against the regulation before anyone budgets against it.
The mechanism underneath the lag is mundane. Take the CRA line requiring vendors to follow all secure coding practices appropriate to development languages and environments [6]. Turning that legal language into something enforceable is work, not a given: someone has to decide which pipeline stage enforces it, write the rule in Rego, the policy language behind Open Policy Agent, test it, and scope it to the right applications [7]. Every new framework restarts that work from scratch, and JFrog argues point-in-time checks produce the feeling of compliance without the substance [14].
Its answer, shipped this week at swampUP 2026, is a catalog of NIST SSDF and EU CRA controls pre-mapped to policy rules in AppTrust, which launched a year earlier at the same event [8][9]. Uncovered controls are flagged, and controls already satisfied by running AppTrust show as covered by default [10]. JFrog says the coverage score tracks production because governance and artifacts share one system of record [17]. NIST SSDF already gates US federal procurement, so the mapping work has a buyer either way [3].
None of this points to anything exploitable, with no CVE, no actor, and no patch window behind it. What changed is the size of the problem: the consequence of a slow answer, and the volume of code now needing one. JFrog says AI agents are now writing code, reviewing pull requests, and pushing changes at rates compliance review was not built for, without putting a figure on it [11].</body_markdown> </invoke>
