Less is safer: Reducing the risk of supply chain attacks