By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

KubeCon + CloudNativeCon North America 2026 takes place November 9–12, 2026, at the Salt Palace Convention Center in Salt Lake City, Utah. CNCF-hosted co-located events run on Monday, November 9, and the main conference opens with keynotes at 9:00 AM MST on Tuesday, November 10.

When and where is KubeCon North America 2026?

Yes. CNCF-hosted co-located events on November 9, including Open Source SecurityCon, Platform Engineering Day, and Agentics Day: MCP + Agents, require an All-Access Pass. Picks 4, 6, 9, 10, 11 and 12 on our list are co-located sessions.

Do I need a separate pass for the co-located events?

Start with "Signed, Sealed, Denied" from AT&T, "I Packaged My Application in a Container Image, and Now What?", and "Mythos vs Maintainers." On Monday, Open Source SecurityCon adds AMPEL for SDLC hardening, VEX at scale, and the OpenSSF golden path panel.

Which KubeCon North America 2026 sessions cover software supply chain security?

Cloudsmith is at Booth 175 in the Solutions Showcase. Catch our booth lightning talk on Tuesday, November 10 at 10:45 AM, play supply chain Jeopardy, and join us at AprèsKube SLC on Wednesday, November 11.

Where can I find Cloudsmith at KubeCon North America 2026?

KubeCon North America 2026 FAQs

The 13 KubeCon + CloudNativeCon North America 2026 sessions we recommend for platform, DevOps, and security teams cover software supply chain security, policy-as-code with OPA and Kyverno, packaging AI agents as OCI artifacts, and governing agentic workloads on Kubernetes. KubeCon North America 2026 runs November 9–12 at the Salt Palace Convention Center in Salt Lake City, Utah. All times below are MST.

With hundreds of sessions across four days, it can be hard to know where to start. We recommend stopping by Cloudsmith at Booth 175 to say hello, play a round of supply chain Jeopardy, and catch a lightning talk from our Head of Security.

As for the conference programming, here's our curated roadmap of the 13 talks we think will help you build with clarity, control, and confidence.

📍 Salt Palace Convention Center (100 S West Temple, Salt Lake City, UT 84101)

1. Signed, Sealed, Denied: Attestation-Driven Admission with Kyverno + CEL at AT&T

Your image is signed. But does its evidence meet your deployment requirements, and can you prove that to an auditor? 

 built platform-managed controls where GitHub Actions emits Sigstore-backed Artifact Attestations and Kyverno's ImageValidatingPolicy evaluates them at admission. Every decision is retained as audit evidence.

This is our top pick because it tackles a problem platform teams know well: internal builds and upstream images with different trust roots, living side by side. The talk covers mixed-source verification in Kyverno 1.19 and 1.20, plus patterns for exceptions and failure handling. If you want compliance that runs at machine speed instead of through spreadsheets, start here.

 Hyatt Regency | Level 4 | Regency Ballroom B-D

An AI agent consists of a model, prompts, skill files, MCP servers, and code spread across Git repos, object storage, and loose config files. In this lightning talk, 

 shows how KitOps, a CNCF Sandbox project, bundles all of it into one versioned, immutable OCI artifact called a ModelKit, signed with Cosign and pushed to any registry you already use.

When something breaks, the first question is always "what was actually running?" Treating agents as versioned artifacts gives AI the same provenance and governance teams already expect for container images and packages.

3. Mythos vs Maintainers: Drowning in the Vulnerability Tsunami

 Hyatt Regency | Level 2 | Salt Lake Ballroom DE

LLMs are changing both sides of open source security. Attackers use them to scale campaigns against GitHub Actions misconfigurations and package ecosystems like PyPI and npm, while well-meaning researchers use them to file a flood of vulnerability reports. 

 play out both roles, attacker and maintainer, using real examples from in-toto's Witness project.

The session moves from recon and disclosure to remediation and using AI to proactively secure the project. For anyone consuming open source at scale, it's a look at why the trust decisions you make about upstream packages matter more than ever.

See the Mythos vs Maintainers session details

4. The Golden Path Doesn't Exist Yet: What Platform Teams Told Us About OpenSSF Tools

The OpenSSF DevRel community asked platform teams a blunt question: what's standing between "this is a good idea" and "this is working for us"? 

 report back on the real blockers, from SBOM accuracy and portability to air-gapped friction, and map them against Sigstore, Zarf, GUAC, and SLSA.

This panel addresses the gap between supply chain tooling and day-to-day adoption. Platform teams should expect to learn which tools solve which problems today.

See the OpenSSF golden path panel details

5. Rego Without Borders: Breaking Down Language Barriers for Security Policy

 will show how the Rego Intermediate Representation lets the compiler generate execution plans that other languages consume natively, so Rego-powered security policy can run inside Swift and Java applications too.

At Cloudsmith, teams write policy-as-code in Cloudsmith using OPA and Rego. Consistent policy across more runtimes means fewer gaps between what you intend and what you enforce.

See the Rego Without Borders lightning talk details

6. Set the Terms for Your Agents and Let Your Humans Be Creative: How to Govern Code Nobody Reviewed

 Salt Palace | Level 1 | Grand Ballroom BDF

Anyone can generate an application in minutes, but deploying it safely remains a challenge. 

 give platform owners a framework of "desired state" abstractions that let teams develop, deploy, and verify AI-generated code. Their live demos start with vibe-coded apps that violate SLSA, GDPR, and internal architecture decisions, then bring them into line.

This session treats AI-assisted coding as something to enable, not fear, and puts the guardrails in the platform rather than in a review queue. That's the same approach Cloudsmith takes toward governing the dependencies those apps pull in.

See the governing AI-generated code session details

7. I Packaged My Application in a Container Image, and Now What?

You built your image and pushed it to a registry, but what comes next? 

 walks step by step through signing images, generating an SBOM, checking for vulnerabilities and whether they're exploitable, and using attestations, with live demos you can repeat locally and in CI/CD.

This session looks to be one of the clearest on-ramps to software supply chain security on the schedule.

See the container image supply chain session details

8. The Identity Crisis: Who is the AI Agent in Your Cluster?

Kubernetes was built for deterministic, stateless microservices with static identity boundaries. AI agents generate dynamic network calls, trigger external APIs, and run machine-generated code on the fly. In this keynote, 

 asks a simple question with big consequences: when an agent calls a tool or a database, what identity does it present?

Identity is the foundation every other control builds on, from authorization to audit. This keynote sets up a theme you'll hear all week, and the emerging open source standards that aim to answer it.

9. End to End Software Development Lifecycle Hardening with AMPEL

Hardening a pipeline requires a lot of checking: who can run CI, how repositories are configured, commit signatures, build provenance, and vulnerabilities. There's a tool for each step, but stitching them together gets messy fast. 

 introduces AMPEL, a supply chain policy engine that uses policy-as-code to evaluate each stage of the SDLC and block builds that don't meet the bar.

This is a hands-on session, so bring a laptop and a project. You'll map controls to frameworks like the OSPS Baseline and NIST SSDF.

10. Upstream First Security: Keeping Telco Infrastructure Secure at Cloud Native Scale

When a CVE lands in a Go dependency under 5G infrastructure, waiting until next quarter isn't an option. 

 share how they triage CVEs across a dependency tree spanning 15+ upstream repositories, why they always fix upstream first, and how they keep production within one minor version of the latest release.

They'll share info about time to fix and the real cost of backporting versus upgrading. This should be a grounded business case for treating dependency hygiene as a core engineering practice.

See the upstream-first security session details

11. Creating VEX Documents at Scale: A Look into One Supplier's Process

What is a VEX, what goes into it, and when should you create one? In this lightning talk, 

 answers those questions through a case study of how 

 is preparing to automate VEX document creation, covering CSAF VEX required fields and OpenVEX.

With the EU Cyber Resilience Act (CRA) asking for VEX alongside SBOMs, and AI speeding up vulnerability discovery, VEX is how suppliers tell customers which vulnerabilities actually matter.

See the VEX at scale lightning talk details

12. The Agent Did What? Reconstructing MCP Tool-Call Attacks

 Salt Palace | Level 1 | Grand Ballroom IG

An agent reads a web page with a hidden instruction, then uses Model Context Protocol (MCP) tools to retrieve data and send it outside your environment. 

 reproduces the attack in a controlled demo, then rebuilds it step by step by joining MCP tool-call logs with cloud audit logs, using a minimal MCP audit proxy that emits OpenTelemetry spans to Jaeger.

This session shows how to build a repeatable method for turning an agent incident into a trace, and gives a clear sense of what those logs can and can't prove.

See the MCP tool-call attacks session details

13. Platform Engineering after the AI Hype: Why IDPs Must Become Intent-Driven

 Hyatt Regency | Level 2 | Salt Lake Ballroom C

 looks at what comes after the first wave of platform engineering: templates, golden paths, and self-service APIs. Infrastructure requests now come from copilots and agents operating at machine speed, so platforms need capabilities that encode organizational policy, security, and operational knowledge for humans and AI alike.

See the intent-driven IDPs session details

Cloudsmith is a Gold sponsor at KubeCon North America 2026, and we're bringing plenty to keep you busy between sessions. Find us at Booth 175 in the Solutions Showcase.

 On Tuesday, November 10 at 10:45 AM, our Head of Security 

Patient zero is a dependency: tracing one attack two ways

. Grab a coffee after the keynotes and join us.

Claire Speedy

Senior Marketing Manager

13 KubeCon North America 2026 sessions not to miss

GitHub Universe 2026 takes place October 28–29, 2026, at Fort Mason Center in San Francisco, CA. Doors open at 7:30 AM on day one, with the opening keynote at 9:00 AM. The closing keynote starts at 2:00 PM on October 29. A separate Day of Learning runs at GitHub HQ on October 30 and needs its own ticket.

When and where is GitHub Universe 2026?

Yes. The virtual pass is free and includes the streamed keynotes, virtual-only content and access to session recordings once they're available. In-person passes are $1,399, with 20% off for groups of four or more.

Can I attend GitHub Universe 2026 virtually?

Cloudsmith is a Gold sponsor in the Festival Pavilion during expo hours on October 28 and 29. Look for the Cloudsmith coffee cart. On October 28 from 6:00 to 9:00 PM, join us at San Francisco Brewing Company for DevOps on Draft: A Universe Git-Together.

Where can I find Cloudsmith at GitHub Universe 2026?

Frequently asked questions (FAQs)

The 10 GitHub Universe 2026 sessions we recommend for platform, DevOps, and security teams cover software supply chain security for npm and GitHub Actions, guardrails for AI agents, agentic workflows at scale, and enterprise AI adoption. GitHub Universe 2026 runs October 28–29 at Fort Mason Center in San Francisco, with a free virtual pass for online attendees.

GitHub Universe 2026 at a glance: dates, location, and agenda tips

More than 6,000 developers, platform engineers, and security leaders are heading to Fort Mason Center for GitHub Universe 2026. This year's theme is the agentic era, and the big question isn't whether to bring AI into the software development lifecycle. It's how to do it at scale, with trust built in from the first commit.

With 100+ sessions across two days, there are a lot of options. We've picked the 10 talks we think platform, DevOps, and security teams will get the most from. Cloudsmith will be in the Festival Pavilion all week, so come and find us between sessions.

📍 Fort Mason Center, San Francisco, CA

👋 Festival Pavilion (look for the Cloudsmith coffee cart)

1. What happens behind the scenes when you run npm install

Wednesday, Oct 28 | 4:30 PM - 5:10 PM PDT

Most people run npm install dozens of times a day without a second thought. Karen Li and Leo Balter from GitHub will trace those dependencies back through the people, permissions and release processes that publish and protect them. Expect a clear look at what npm audit can't catch, and where package provenance and OpenID Connect (OIDC) fit in.

This is our top pick because software is assembled more than it's authored, and every install is a trust decision. Knowing how a package reaches your build is the first step to governing it. If you leave this talk wanting to control what enters your environment before it arrives, come and see us in the Festival Pavilion.

2. Disrupting supply chain attacks: A threat framework for GitHub Actions

Wednesday, Oct 28 | 2:30 PM - 3:00 PM PDT

A workflow with access to credentials and the power to publish a release is a high-value target for attackers. Steve Glass and Greg Ose will map known supply chain attack techniques to the GitHub Actions controls that stop them, across three layers: the Actions ecosystem, the workflow attack surface, and runner infrastructure.

For platform teams, this is a practical framework for deciding where defenses belong in a pipeline you'd trust with a release. Incidents like tj-actions showed why the build pipeline is a critical control point. This session moves the conversation from what went wrong to what good looks like.

3. Open pull requests, don't merge them: Fine-grained authorization for hosted MCP servers

Thursday, Oct 29 | 10:30 AM - 10:45 AM PDT

Hosted MCP servers often enable agents to do everything a human can do. Nick Taylor will demo an identity-aware proxy that adds per-identity authorization in front of any hosted MCP server, with no upstream changes. The live demo shows Copilot opening a pull request and leaving the merge to a human reviewer.

We love this session because it treats guardrails as infrastructure, not an instructions file the agent might ignore. The same principle applies to dependencies. Agents move fast, so the controls around them need to be machine-enforceable and in place before the agent acts.

4. From writing code to managing agents: Scaling 50+ services at GitHub

GitHub's Lifecycle team swapped hand-coded fixes across 50+ services for an agentic pipeline. AI agents classify issues, research codebases, write implementation plans, and open draft pull requests. Anjuan Simmons will share the real numbers, how the team built it with GitHub Actions and Copilot, and why engineers still write some code by hand on purpose.

This is a look at agents running in production at platform scale. For engineering leaders weighing the same move, it's a grounded blueprint for where automation pays off and where humans stay in the loop.

5. Treat your AI context as infrastructure

 Platform engineering, developer experience

Having the right context is critical for getting your agents to generate useful output. In this session, Christopher Harrison will break down what custom agents, agent skills, instructions files, MCP servers, extensions, and plugins each do best, and how to choose between them for real use cases. He’ll discuss strategies for how to distribute the right context consistently across a team as your setup grows.

Platform engineers already know this story. Anything that works for one developer but can't be versioned, shared, and governed becomes sprawl. This session applies golden path thinking to AI context, and it's a natural fit for teams looking to build those paths for their developers.

6. Beyond pass or fail: How agents verify AI-generated code

The tests passed, so why is the app still broken? Jeff An will show how agents investigate applications, reproduce unexpected behavior, and tell real product bugs apart from flaky tests or infrastructure failures. He'll also cover the deterministic controls that limit what those agents can do while they investigate.

As AI writes more of our code, verification becomes the bottleneck. This talk looks at earning the trust that speed requires, with clear boundaries on what agents are allowed to touch.

7. The 2 a.m. RCA agent: Architecting AI that investigates, not hallucinates

Anyone who has had to spend hours late at night researching root cause analysis (RCA) will want to attend this one. Achin Gupta and Divya Mahajan will present a RCA architecture where deterministic code handles signal collection, topology traversal, correlation, and scoring. The language model only narrates evidence it didn’t have to collect.

The result is a clean split of responsibilities where the machine-enforceable parts stay deterministic, and the model adds clarity where needed. SREs and platform teams will leave with a design they can borrow.

Wednesday, Oct 28 | 11:30 AM - 12:10 PM PDT

Getting developers to try Copilot is the easy part. Getting them fluent – using agents to plan, write, and ship real work – is harder. Jared Hatfield will share how UPS moves developers from awareness to fluency, why motivation and measurement matter as much as tooling, and where to focus first at enterprise scale.

For VPs of Engineering and platform leads rolling out AI across large organizations, this is a candid view from a team doing it today. Adoption at this scale also means more packages, pulled faster, by more people and agents. It's worth planning the controls alongside the rollout.

9. Code is the easy part: Building Home Assistant in the open

Wednesday, Oct 28 | 2:10 PM - 2:25 PM PDT

Home Assistant builds everything in the open, from ideas and UX to architecture and the roadmap itself, across 20,000 contributors and a dozen GitHub organizations. Franck Nijhof will show how the Open Home Foundation runs its whole roadmap through issues, projects, and discussions, including being wrong in public and fixing it in public.

Open source is the foundation for every modern software supply chain. This session is a great reminder of the people and process behind the packages we all depend on, and what it takes to run a healthy project at scale.

10. The view from the labs: What's next for AI-assisted development

 Cara Phillips, Anthropic; Rohan Varma, OpenAI; Kate Catlin, GitHub

To close out our list, an interactive panel with leaders from the labs that power GitHub Copilot. Cara Phillips, Rohan Varma, and Kate Catlin will take a candid look at the next two years of AI-assisted development, and what it means for the people building software.

AI changes the laws of physics for how fast teams can move. Hearing where model capabilities are going next will help platform and security teams plan the guardrails that let developers and agents keep that pace.

Between sessions, come and say hello. Cloudsmith is a Gold sponsor at GitHub Universe 2026, and you'll find us in the Festival Pavilion throughout expo hours on October 28 and 29.

 Grab a drink from the Cloudsmith coffee cart and refuel before your next session.

 Watch how Cloudsmith acts as the control layer for your software supply chain. Govern every package, container, and ML model that enters your environment, enforce policy-as-code at first pull, and publish straight from GitHub Actions with OIDC (no long-lived API keys).

 Bring your questions about AI coding tools, dependency governance, or moving off a self-hosted artifact server. Our engineers are happy to dig in.

Join us for DevOps on Draft: A Universe Git-Together

Wrap up day one with us. On Wednesday, October 28, from 6:00 to 9:00 PM, Cloudsmith is hosting a happy hour at San Francisco Brewing Company, co-sponsored by Tailscale, Eficode, Octopus Deploy, and Chainguard. Expect good beer, good company, and plenty of conversation about what everyone saw that day. Spaces are limited, so 

AI is changing how fast teams build software, and that's exciting. We'll see you in San Francisco to talk about keeping that speed with clarity, control and confidence.

10 GitHub Universe 2026 sessions not to miss

KubeCon + CloudNativeCon North America 2025 is almost here, bringing together thousands of developers, security leaders, and platform engineers, to explore the latest in cloud-native technology. With dozens of talks, workshops, and keynotes across multiple tracks, it can be tough to know where to focus your time. To help, we’ve curated a list of 

 covering security, AI, cloud-native innovation, and platform engineering - including some interactive, hands-on experiences.

Georgia World Congress Center, Atlanta, GA


1. Kong AI gateway & insomnia workshop: AI success through API heroics

 Embassy Suites by Hilton Atlanta at Centennial Olympic Park

 is hosting this hands-on workshop exploring how AI-driven APIs can streamline workflows and improve automation. Attendees will work with Kong’s API Gateway and Insomnia tools to see practical examples of AI integration in real-world projects. If you’re curious about how Kong secures its software supply chain while supporting modern development practices, check out their 

2. Project lightning talk: The same great OPA, only faster

 Building C | Level 3 | Georgia Ballroom 2

 performance, demonstrating how teams can implement faster, more efficient policy-as-code pipelines. Learn tips and tricks for maintaining security and compliance at scale, while reducing the friction often associated with enforcing policies in CI/CD pipelines.

3. Capture the Flag challenge: Defend the pipeline

 Hilton Garden Inn Atlanta Downtown | Atlantic Room - 2nd Floor

 where you’ll defend a CI/CD pipeline against realistic attack scenarios. Participants can test their skills against malicious packages, misconfigurations, and supply chain threats, all in a safe, gamified environment. This session is a great way to see security best practices in action and get hands-on experience defending a modern software pipeline.

4. Keynote: Supply chain reaction - a cautionary tale in K8s security

This keynote examines lessons learned from major supply chain attacks and highlights how Kubernetes environments can be hardened against similar risks. Security leaders and DevOps teams will gain actionable insights on improving artifact integrity, detecting threats early, and reducing downstream risk across CI/CD pipelines.

5. Keynote: Maximum acceleration - Cloud Native at the speed of AI

’s Joseph Sandoval explores how cloud-native architectures can be optimised for AI-driven workloads. The session covers practical strategies for designing infrastructure that can scale dynamically, accelerate development cycles, and maintain operational reliability while supporting AI initiatives across the enterprise.

6. Taming the complexity beast: Rethinking software architecture & deployment

This session brings together engineers from 

, and other organisations to share how they simplify complex architectures and streamline deployments. Learn practical approaches for reducing operational overhead, improving reliability, and supporting fast-moving development teams across multiple platforms.

7. Platform Engineering day zero: The origin story

’s Murriel McCabe shares a blueprint for building scalable platform engineering teams from scratch. Attendees will learn how to structure teams, select tooling, and define processes that maximise productivity and maintain developer velocity from day one.

8. Keynote: There’s nothing to fear about the EU’s new Cybersecurity Law

Linux Kernel maintainer Greg Kroah-Hartman explains the implications of the EU’s new cybersecurity legislation for open-source projects and enterprise security teams. This session is essential for anyone responsible for compliance or managing public and private codebases.

9. Turn up the heat: Driving cloud-native innovation into real-world impact

Learn from real-world examples of how organisations are accelerating innovation while maintaining secure, reliable cloud-native deployments. This session highlights strategies for balancing velocity with compliance, and how cloud-native principles can drive tangible business outcomes.

10. The hidden risks in AI/ML supply chains: How to secure your workloads

 Building B | Level 5 | Thomas Murphy Ballroom 1

 explores the emerging security challenges in AI/ML pipelines, including model provenance, dependency risks, and how malicious artifacts can propagate across environments. Attendees will get actionable guidance on securing AI workloads in production.

11. Cloud-native back to the future: The road ahead

 leaders discuss the evolution of cloud-native practices, including modern tooling, automation strategies, and architectural patterns that will define the next era of software delivery.

12. Ulysses: Odyssey through platform engineering

 takes attendees on a deep dive into platform engineering maturity, sharing lessons learned, best practices, and practical advice for building reliable developer experiences at scale.

13. Mapping the next phase: Updating the Cloud-Native maturity model for 2025

 explore how cloud-native maturity models are evolving in the AI era and what this means for teams designing future-ready infrastructure. This session is ideal for technical leads planning long-term

 at KubeCon + CloudNativeCon 2025! Gain insights from booth lightning talks, get hands-on with live demos, and swap ideas with engineers solving the same challenges you are. Our team will be on hand to demo our cloud-native artifact management platform, answer your questions, and share tips on securing your software supply chain, securely sourcing LLM models, and improving CI/CD pipeline processes. We can’t wait to connect with you in person and explore how Cloudsmith can help your teams move faster, stay secure, and embrace modern development practices.

test

13 sessions not to miss at KubeCon and CloudNativeCon 2025

Optimized for distributed teams working at any scale, Cloudsmith is your single source of truth for software assets. Proxy and cache to public upstreams, and use our Zero Trust model to control access to your most valuable IP. We’ve spent years creating the industry’s only true cloud-native solution to global software distribution at any scale. Let’s get you shipping without friction!

We are bringing a team of software supply chain experts to KubeCon including our CEO 

. Our on-site team can provide tailored advice to your team’s unique situation.

On-site demo spots are going fast so be sure to 

Free Software Supply Chain Security consultation

Stop by our booth to grab a voucher for a free 1-hour Software Supply Chain Security consultation. Let our team show you how you can swap risky development practices and insecure pipelines for end-to-end software supply chain control and security with Cloudsmith after KubeCon has ended. Spots are limited!

Stop by our booth to take our software supply chain security survey for your chance to win a MacBook Air and grab some of our awesome Cloudsmith swag!

 to bring you this year’s passport program! Grab a card from any participating sponsor booth and collect stamps for your chance to win a Meta Quest 5, Playstation Portal Remote or LEGO Paris Architecture Set.

Cloudsmith is headed to Paris for KubeCon Europe 2024

In a world where digital threats lurk at every corner, securing your software supply chain is vital. Without proper tooling, you can’t adequately protect it.

Over the past few months, software supply chain attacks have compromised thousands of organizations. Okta, users of Progress Software's MOVEit file transfer app, and JetBrains’ TeamCity On-Premise development platform are just a few. In 2020, the notorious 

 infected more than 18,000 customers, including Microsoft, Intel, and roughly 100 other companies, as well as a dozen U.S. government agencies.

research suggests the financial impact of supply chain attacks is rising by 15% annually. They predict that the cost to businesses will reach $60 billion by 2025 and $138 billion by 2031. This alarming trend underscores the urgency for robust security measures and regular audits to safeguard against these evolving threats.

Software supply chain security involves protecting all aspects of the software development and deployment process. It's not just about the code you write, but also about the third-party components you integrate. Common threats include 

inadequate control over third-party libraries

. Open source software has accelerated the speed of development and delivery, and is present in an estimated 96% of computer software, according to the 

Open Source Security and Risk Analysis Report 2023.

 Every element, from source code to deployment, is a potential vulnerability point.

Ignoring these risks can lead to catastrophic data breaches and operational disruptions.

How can I mitigate my risk of exposure to a software supply chain attack?

A thorough security audit is essential for identifying and mitigating risks in your software supply chain. So where do you start?

Cloudsmith Blog

13 KubeCon North America 2026 sessions not to miss

10 GitHub Universe 2026 sessions not to miss

13 sessions not to miss at KubeCon and CloudNativeCon 2025

Cloudsmith is headed to Paris for KubeCon Europe 2024

How to Audit Your Software Supply Chain Security