A computer-implemented method includes determining, by a processor, an authenticity of a software object and its supply chain and providing an authenticity result indicative thereof; determining, by the processor, an integrity of the software object and its supply chain and providing an integrity result indicative thereof; and determining, by the processor, from the authenticity result and the integrity result, a score indicative of an amount of trust in the supply chain of the software object and in the software object, wherein the score is indicative of an amount of trust that the software object will work correctly if installed in a system that utilizes the software object.