Supply chain attacks are increasing despite SBOM mandates. A researcher proposes a smarter decision model for defense.