i suspect awareness on supply-chain attacks is already low (though it seems to be increasing in recent times). the attack surface is everything an agent can get their hands on.