About half (49%) of companies say they lack the visibility to fully understand – or even identify – software supply chain risks.