By submitting this form, you agree to our 

KubeCon + CloudNativeCon North America 2025 is almost here, bringing together thousands of developers, security leaders, and platform engineers, to explore the latest in cloud-native technology. With dozens of talks, workshops, and keynotes across multiple tracks, it can be tough to know where to focus your time. To help, we’ve curated a list of 

 covering security, AI, cloud-native innovation, and platform engineering - including some interactive, hands-on experiences.

Georgia World Congress Center, Atlanta, GA

1. Kong AI gateway & insomnia workshop: AI success through API heroics

 Embassy Suites by Hilton Atlanta at Centennial Olympic Park

 is hosting this hands-on workshop exploring how AI-driven APIs can streamline workflows and improve automation. Attendees will work with Kong’s API Gateway and Insomnia tools to see practical examples of AI integration in real-world projects. If you’re curious about how Kong secures its software supply chain while supporting modern development practices, check out their 

2. Project lightning talk: The same great OPA, only faster

 Building C | Level 3 | Georgia Ballroom 2

 performance, demonstrating how teams can implement faster, more efficient policy-as-code pipelines. Learn tips and tricks for maintaining security and compliance at scale, while reducing the friction often associated with enforcing policies in CI/CD pipelines.

3. Capture the Flag challenge: Defend the pipeline

 Hilton Garden Inn Atlanta Downtown | Atlantic Room - 2nd Floor

 where you’ll defend a CI/CD pipeline against realistic attack scenarios. Participants can test their skills against malicious packages, misconfigurations, and supply chain threats, all in a safe, gamified environment. This session is a great way to see security best practices in action and get hands-on experience defending a modern software pipeline.

4. Keynote: Supply chain reaction - a cautionary tale in K8s security

This keynote examines lessons learned from major supply chain attacks and highlights how Kubernetes environments can be hardened against similar risks. Security leaders and DevOps teams will gain actionable insights on improving artifact integrity, detecting threats early, and reducing downstream risk across CI/CD pipelines.

5. Keynote: Maximum acceleration - Cloud Native at the speed of AI

Adobe’s Joseph Sandoval explores how cloud-native architectures can be optimized for AI-driven workloads. The session covers practical strategies for designing infrastructure that can scale dynamically, accelerate development cycles, and maintain operational reliability while supporting AI initiatives across the enterprise.

6. Taming the complexity beast: Rethinking software architecture & deployment

This session brings together engineers from Chainguard, IBM, and other organizations to share how they simplify complex architectures and streamline deployments. Learn practical approaches for reducing operational overhead, improving reliability, and supporting fast-moving development teams across multiple platforms.

7. Platform Engineering day zero: The origin story

Google’s Murriel McCabe shares a blueprint for building scalable platform engineering teams from scratch. Attendees will learn how to structure teams, select tooling, and define processes that maximize productivity and maintain developer velocity from day one.

8. Keynote: There’s nothing to fear about the EU’s new Cybersecurity Law

Linux Kernel maintainer Greg Kroah-Hartman explains the implications of the EU’s new cybersecurity legislation for open-source projects and enterprise security teams. This session is essential for anyone responsible for compliance or managing public and private codebases.

9. Turn up the heat: Driving cloud-native innovation into real-world impact

Learn from real-world examples of how organizations are accelerating innovation while maintaining secure, reliable cloud-native deployments. This session highlights strategies for balancing velocity with compliance, and how cloud-native principles can drive tangible business outcomes.

10. The hidden risks in AI/ML supply chains: How to secure your workloads

 Building B | Level 5 | Thomas Murphy Ballroom 1

Yash Pimple from Chainguard explores the emerging security challenges in AI/ML pipelines, including model provenance, dependency risks, and how malicious artifacts can propagate across environments. Attendees will get actionable guidance on securing AI workloads in production.

11. Cloud-native back to the future: The road ahead

Microsoft and Akamai leaders discuss the evolution of cloud-native practices, including modern tooling, automation strategies, and architectural patterns that will define the next era of software delivery.

12. Ulysses: Odyssey through platform engineering

William Rizzo of Mirantis takes attendees on a deep dive into platform engineering maturity, sharing lessons learned, best practices, and practical advice for building reliable developer experiences at scale.

13. Mapping the next phase: Updating the Cloud-Native maturity model for 2025

Akamai, StackEgy, and Glennium explore how cloud-native maturity models are evolving in the AI era and what this means for teams designing future-ready infrastructure. This session is ideal for technical leads planning long-term

 at KubeCon + CloudNativeCon 2025! Gain insights from booth lightning talks, get hands-on with live demos, and swap ideas with engineers solving the same challenges you are. Our team will be on hand to demo our cloud-native artifact management platform, answer your questions, and share tips on securing your software supply chain, AI artifacts, and CI/CD pipelines. We can’t wait to connect with you in person and explore how Cloudsmith can help your teams move faster, stay secure, and embrace modern development practices.

Claire Speedy

Senior Marketing Manager

13 sessions not to miss at KubeCon and CloudNativeCon 2025

Optimized for distributed teams working at any scale, Cloudsmith is your single source of truth for software assets. Proxy and cache to public upstreams, and use our Zero Trust model to control access to your most valuable IP. We’ve spent years creating the industry’s only true cloud-native solution to global software distribution at any scale. Let’s get you shipping without friction!

We are bringing a team of software supply chain experts to KubeCon including our CEO 

. Our on-site team can provide tailored advice to your team’s unique situation.

On-site demo spots are going fast so be sure to 

Free Software Supply Chain Security consultation

Stop by our booth to grab a voucher for a free 1-hour Software Supply Chain Security consultation. Let our team show you how you can swap risky development practices and insecure pipelines for end-to-end software supply chain control and security with Cloudsmith after KubeCon has ended. Spots are limited!

Stop by our booth to take our software supply chain security survey for your chance to win a MacBook Air and grab some of our awesome Cloudsmith swag!

 to bring you this year’s passport program! Grab a card from any participating sponsor booth and collect stamps for your chance to win a Meta Quest 5, Playstation Portal Remote or LEGO Paris Architecture Set.

Cloudsmith is headed to Paris for KubeCon Europe 2024

In a world where digital threats lurk at every corner, securing your software supply chain is vital. Without proper tooling, you can’t adequately protect it.

Over the past few months, software supply chain attacks have compromised thousands of organizations. Okta, users of Progress Software's MOVEit file transfer app, and JetBrains’ TeamCity On-Premise development platform are just a few. In 2020, the notorious 

 infected more than 18,000 customers, including Microsoft, Intel, and roughly 100 other companies, as well as a dozen U.S. government agencies.

research suggests the financial impact of supply chain attacks is rising by 15% annually. They predict that the cost to businesses will reach $60 billion by 2025 and $138 billion by 2031. This alarming trend underscores the urgency for robust security measures and regular audits to safeguard against these evolving threats.

Software supply chain security involves protecting all aspects of the software development and deployment process. It's not just about the code you write, but also about the third-party components you integrate. Common threats include 

inadequate control over third-party libraries

. Open source software has accelerated the speed of development and delivery, and is present in an estimated 96% of computer software, according to the 

Open Source Security and Risk Analysis Report 2023.

 Every element, from source code to deployment, is a potential vulnerability point.

Ignoring these risks can lead to catastrophic data breaches and operational disruptions.

How can I mitigate my risk of exposure to a software supply chain attack?

A thorough security audit is essential for identifying and mitigating risks in your software supply chain. So where do you start?

1. Build an inventory of your software supply chain

Map your entire software supply chain to understand where vulnerabilities may exist. You need to list all of your software components, as each presents a potential risk. This includes the code your team writes and all the third party libraries, frameworks, and tools you use to build and deploy your software. Don’t forget about database systems, orchestration tools, and cloud services. For each component, understand its:

Without the right tooling this can be difficult, especially if you have multiple teams that are on different technology stacks or using separate DevOps tools. You need a fully-managed software supply chain product like 

 to know what artifacts your teams are using and where the potential risks lie.

Now that you have mapped each component in your software supply chain, you need to assess its security posture against known vulnerabilities and industry standards. Tools like 

, a free tool for analyzing the quality and security of OSS packages, cangive you insights into the quality and trustworthiness of open-source packages.In addition, standards like the 

 from OWASP can help you determine your dependencies and check them for publicly disclosed vulnerabilities.

Once you’ve identified potential vulnerabilities in your chain, it's time to formulate a plan to address identified vulnerabilities, including updating or replacing insecure components.This may include patching software, updating systems, changing code, or even replacing certain tools or components. It’s crucial to have a detailed action plan for each type of vulnerability.

Continuously monitor to protect your supply chain:

Your software supply chain is not static. Every day your development teams and the global open-source community make software changes that could impact your security. New vulnerabilities are being discovered and new threats emerge. To maintain security in your software supply chain, you must automate ongoing surveillance of the supply chain while enabling your developers to continue innovating at pace.

Use Cloudsmith to streamline your audit process and secure your software supply chain.

Build your software supply chain inventory

 by creating a single source of truth for all your software assets with Cloudsmith. We provide one home for all your components, supporting all of your programming languages, teams, and development pipelines. Each and every package pulled into Cloudsmith is fully traceable, giving you insight into what software was built using what dependencies and by which teams and developers.

. Artifacts coming into your Cloudsmith repositories are subject to the policies and controls that you configure. SBOMs contain all of the components and dependencies, and Cloudsmith ensures the authenticity and origin of your artifacts by scanning your packages for malware and CVE.

 Cloudsmith makes it easy to establish rules-based protocols for handling low, medium, and critical software vulnerabilities so that risks are stopped and quarantined before they can do damage.

Stay in control of your software supply chain

. Build usage policies, pin dependencies, segregate environments, and use package promotion workflows to ensure the right teams, people, and systems have access to use the packages that meet your specific needs.

Continuously monitor and protect your software supply chain.

 Cloudsmith is cloud-based, offering enhanced speed, security, and ease of use. Our multi-tenant, global infrastructure means you can rely on the platform to scale to meet your needs and not worry about troublesome upgrades that lead to lost productivity and developer frustration.

Mastering software supply chain security audits is not just a matter of implementing a set of procedures; it's a continuous commitment to safeguarding your digital ecosystem. As we've seen with high-profile breaches and the rise in attack frequency and sophistication, no organization can afford to overlook this crucial aspect of cybersecurity.

By maintaining an inventory of your software supply chain, vigilantly assessing vulnerabilities, promptly addressing them, and continuously monitoring for new threats, you can create a robust defence against the ever-evolving landscape of digital risks.

Cloudsmith plays a pivotal role in securing the software supply chains of diverse and global clients like PagerDuty, Stack Overflow, FontAwesome, Shopify, and RabbitMQ. With Cloudsmith, the fast, modern artifact management platform, you can ensure that your software supply chain remains secure, resilient, and ahead of the curve in cybersecurity. 

Cloudsmith Blog

13 sessions not to miss at KubeCon and CloudNativeCon 2025

Cloudsmith is headed to Paris for KubeCon Europe 2024

How to Audit Your Software Supply Chain Security