Many of us in the technology industries are challenged to deliver increasingly complex systems at lower cost, under time pressure, while guaranteeing safety and security.

Inevitably this pressure leads to reliance on third-party software, both proprietary and FOSS. But most organisations are so busy with their own engineering that they struggle to track what's happening in their supply chains.

This talk will explore some systemic problems (commercial, practical and philosophical, as well as technical) that responsible organisations and technical leads face when combining multi-party code in environments where the whole target is expected to be safe, secure or both. An evidence-based approach to solutions will be presented, as a framework for 'trustable software engineering'.