By submitting this form, you agree to our 

I learned to code in BASIC on a Commodore 64 in the early 1980s. BASIC was actually a pretty neat high-level abstraction of assembly language, which itself was an abstraction sitting on top of machine code! Since then, I’ve seen a steady stream of higher-level abstractions - relational databases, object-oriented languages, package dependencies, open source libraries, cloud-native development, containers, serverless - that have made software developers more productive, and helped us build ever more powerful applications with them.

AI is the latest abstraction layer that sits on top of existing technology, making the underlying components more powerful and easier to use. A huge amount of R&D and startup capital in the past few years has gone towards exploiting this new abstraction.

The newest and best ideas naturally attract top talent and funding. Companies and startups building cool new AI-powered apps have their choice of tech stack. And many of them are creating their new software development tool chains around Cloudsmith, which is very satisfying to Cloudsmithers.

, who built an AI-powered platform pathologists use to diagnose cancers. They manage binary packages in Cloudsmith that they use to build for a wide variety of target environments. Or 

, who builds industrial computer vision applications that improve quality and productivity, using Cloudsmith to manage binary artifacts that go into their build pipelines. 

 provides a machine learning platform for document processing and automation, built on Cloudsmith for internal development and external distribution of containers and packages. And 

, who have built an AI-powered due diligence platform, using Cloudsmith as their single source of truth for binary artifacts.

Companies that build critical infrastructure for use by other AI companies are also gravitating to Cloudsmith. Take 

, who helps organizations use, manage, and govern AI metadata with their enterprise-grade context platform. They chose Cloudsmith to make sure their artifacts are reliably and securely distributed to enterprise developers. Or 

, who distributes their SDKs and runtimes via Cloudsmith for delivery of AI-driven perception solutions to robotics and computer vision tool companies. Then there’s 

, an open source AI search platform used to develop and run large-scale applications, combining big data, vector search, machine-learned ranking, and real-time inference to enable AI applications like retrieval-augmented generation, recommendation, and intelligent search at enterprise scale. Cloudsmith supports distribution for Vespa, streamlining delivery for their open source community as well as enterprise users.

And then it’s companies who deliver AI directly to the hands of end users. 

 calls itself “the world’s most private AI,” assisting users in real time across a wide range of personal tasks. They use Cloudsmith to build and distribute packages across the software supply chain.

Cloudsmith is best known for our enterprise-grade artifact management platform, which controls and secures the software supply chain for the world’s most demanding Fortune 500 and Global 2000 organizations. But there’s a reason we also show up so often as the platform of choice for innovative AI startups and spinoffs. These companies are typically run by lean teams of seasoned software engineers. They know what they need, and they want to do it right the first time. They want developer-friendly, well-documented tools that just work.

 to manage their Hugging Face models and datasets, and we’re increasingly powering our own development of new features with AI tools. But it’s also notable that the world’s most interesting AI companies are also choosing Cloudsmith - not just to manage ML models, but to power their entire software supply chain. That’s a vote of confidence that makes us proud to be Cloudsmithers.

Glenn Weinstein

The platform of choice for AI companies

the artifact management market is up for grabs

. In a hot market, you’re going to see some interesting and not-entirely-logical attacks. And if I could creatively paraphrase 

, it’s hard to get someone to understand something when their company’s success depends on them not understanding it.

I’m thinking about a curious criticism that one of our competitors, JFrog, leveled at us in a 

. They said they spotted some “red flags” about Cloudsmith, the first and most damning being that we are “

packaging [a] competitor’s open source as an enterprise solution,

[s]elling a paid ‘security’ solution that’s little more than a thin UI layer over someone else’s open-source tool.

 and the underlying Trivy DB as one source of software package vulnerability data.)

They stick to this point pretty persistently, saying we are “

charging you for an open-source solution,” 

rely on open source software as [our] SCA solution,

“if Trivy becomes unsupported or compromised, Cloudsmith’s entire SCA capability could suffer, leaving users vulnerable.

JFrog has it wrong on several counts here.

For starters, pretty much every enterprise tool in the last few decades, including 

, is built on foundations of open-source software (OSS). Does this mean we’re all “charging” customers for “packaging” OSS as an “enterprise solution” in some nefarious way? Like most OSS, Trivy DB is “generic by nature,” which leaves room for developers and software vendors to build custom capabilities on top of it. Which is exactly what Cloudsmith has done. If Cloudsmith is wrong for using “generic” OSS, then we’re all wrong.

In accusing Cloudsmith of using a “competitor’s” OSS, they’re referring to Aqua Security. They’re confused on several key points.

First, they’re failing to acknowledge the distinction between the role of a primary OSS maintainer and a commercial vendor. Aqua Security, the company, is the primary maintainer of the Trivy OSS project. It is also the vendor behind Aqua Enterprise, a commercial product that is built around Trivy.

Second, they’ve tellingly assumed that Cloudsmith considers Aqua Security to be a competitor. We very much don’t. We regard Aqua as a complementary solution; we support integration between Cloudsmith and Aqua Security; and we see Cloudsmith as the data plane & control plane for software supply chain security, so customers can process metadata and execute policies based on vulnerabilities identified by Cloudsmith’s scanning process, or sourced from third-party vulnerability data from the likes of Aqua Enterprise or others, or a combination.

 software can “become unsupported.” But that actually tends to be a much bigger risk with commercial software than with OSS. Trivy is published under an Apache 2.0 license. Even if the maintainers stop publishing future versions as open source, the community could fork an older version. We don’t think this will happen, but if it does, Cloudsmith relies on multiple data sources, and we can easily change our mix from time to time. There are numerous other providers of data similar to Trivy’s.

So why is JFrog attacking Cloudsmith so stridently for relying on OSS, like virtually every commercial software company does, and specifically for relying on Trivy? I can only speculate, but JFrog sees its own security product, Xray, as an important revenue source, and they seem to regard Aqua Security, along with other similar companies, as competitors to Xray.

To state the obvious point: of course we embrace open source. 

 about Cloudsmith’s support for OSS projects, and we Cloudsmithers all believe deeply in the power of software reuse via OSS. I’m old enough to remember when reuse was essentially an unsolved problem in software; we never could have envisioned back in the 1990s how OSS would fundamentally change that. The core functionality of our platform helps enterprises everywhere to efficiently and securely manage the thousands of OSS artifacts and dependencies that make up such a large part of any company’s software supply chain.

And to state another obvious point: we’re not just serving up generic OSS and then somehow convincing customers to pay us for it. It’s what Cloudsmith has built on top of OSS that we’re really charging for. Things like our unmatched global cloud-scale infrastructure, our 24x7 service levels, our policy-as-code enterprise policy manager (EPM) that evaluates every package using your company’s risk criteria, our ability to proxy and cache public upstream registries at unmatched performance levels, our artifact synchronization process that performs scanning and metadata enrichment before a package even hits your repository and gets served to CI/CD pipelines or developer IDEs, our stellar customer support, and much more.

Yes, we rely on OSS, and we think that’s a significant strength from which customers benefit.


Of Course We Embrace Open Source!

The enterprise artifact management market - which has belonged for a while to JFrog and Sonatype - is now 

Cloudsmith was built on the core principle that 

. So does simplicity in design and workflow. Partnerships matter, too. We’ve built a comprehensive platform that controls and secures every artifact as it’s built, scanned, signed, stored, and shipped across the software supply chain. We’ve tailored our product to the specific needs of large organizations, which support hundreds of software development teams, rely on a huge range of languages and formats, operate at massive scale, and need to ensure the provenance and integrity of artifacts entering their supply chain.

Our work is paying off. Today our product helps Fortune 500 and Global 2000 corporations, as well as independent software companies, build and distribute their software more securely and efficiently. Many of these customers migrated to Cloudsmith from the two primary legacy solutions on the market - JFrog’s Artifactory, and Sonatype’s Nexus. These customers came to us because they ran into challenges scaling to ever-increasing DevSecOps demands. They asked for a fully managed platform that just works, so they can focus on building software, not infrastructure, CDNs, or clusters. And they recognized Cloudsmith as a fresh, modern, developer-friendly, API-first experience. Cloudsmith is infrastructure you don’t have to think about.

A successful startup transitions into scale-up mode when it solves customer problems in new and innovative ways, and starts to win real market share. Cloudsmith has arrived here. We 

closed our Series B with TCV and Insight Partners

 earlier this year to fund our growth. We’re seeing incumbents take notice. We’re seeing analyst firms like Gartner and Forrester recognizing Cloudsmith as a new and legitimate candidate for enterprises with complex needs. JFrog CFO Ed Grabscheid confirmed our growing market share when he 

told investors at a Bank of America conference

 on June 5 that they see two main competitors: Sonatype and a “

very, very small startup that is a cloud-native tool… not even worth mentioning the name,

” I’m pretty sure he was talking about Cloudsmith.

We agree that large organizations are looking at three main options - JFrog, Sonatype, and Cloudsmith - for comprehensive artifact management. The artifact offerings from hyperscalers like Azure, AWS, and Google, as well as SDLC leaders like GitHub and GitLab, are limited to a handful of formats and use cases. They’re okay for small teams, but they’re not intended to scale across broad engineering organizations. We hear every day from JFrog and Sonatype customers who are curious if Cloudsmith is a viable alternative to their legacy vendor, and from platform engineering teams who recognize the benefits of a common internal set of universal artifact repositories.

I suppose it’s in the spirit of this head-to-head competition that 

 of our advanced security offerings. They didn’t reach out to us in advance, and appear to have based their findings on their use of a Cloudsmith self-service trial account. We would have been happy to help them make a more well-informed comparison! We think their conclusions are misleading or highly confused, and they got a lot flat-out wrong. Our solutions engineers love working with prospective Cloudsmith customers to showcase the actual capabilities of Cloudsmith, in a way that’s relevant to their company’s processes, scale, and needs.

There is one point in JFrog’s analysis of Cloudsmith that I found telling. They seem to fault our approach to artifact security scanning for relying on third-party industry vulnerability data. This outlook seems to align with JFrog’s general position on partnerships (that they’re bad for business). At that same Bank of America conference, JFrog’s CFO said that when it comes to security scanning, “

” cannot operate without having a proxy to JFrog for access to the binary artifacts, which is true. 

you could cut the oxygen off to these point solutions. We choose not to do that, but most customers see advantage to two things: consolidation, and to secure the most critical asset, which is your binary.

We just have a different philosophy. We don’t think customers want their artifact management vendor to be their only source of vulnerability data and security scanning. In other words, not all JFrog Artifactory customers want to depend solely on JFrog Xray. We know that for sure, because they’ve told us. So we’re working hard to ensure Cloudsmith works well with commercial and open source security tools like ClamAV, Trivy, and Grype, as well as data sources like EPSS and CVSS, and we regularly incorporate their data into the metadata that’s available inside Cloudsmith repositories and exposed to our Enterprise Policy Manager (EPM). In this way, Cloudsmith is the control plane and the data plane for the entire software supply chain, but we don’t think we should be the sole provider of security data. We will not - to quote JFrog - “cut the oxygen off” from our partners in the ecosystem. We feel similarly about CI/CD, runtime scanning, observability, and hardened images; solving software supply chain security works best as a team sport.

If you want to see why so many companies are turning to Cloudsmith, 

 about what a modern, scalable, cloud-native artifact platform could look like for your organization.

The Artifact Management Market Is Up For Grabs

cloudsmith_series_b_V6

Today we announced Cloudsmith is officially a Series B company. This $23M fundraising round was led by 

, as well as most of our existing investors. What a vote of confidence in our team, our vision, and our market!

 in 2023 for two reasons: (1) artifact management and software supply chain security are mission-critical to enterprises, and (2) there’s an opportunity for serious disruption of JFrog and Sonatype, the two legacy players.

We now have a pile of evidence that proves this thesis. Over the past year, we’ve closed over 100% of our total pipeline at the start of each quarter. The demand is there. The average deal size is up 5x. We now boast an impressive roster of Fortune 500 and Global 2000 companies that have made the switch - on behalf of their hundreds of software teams and thousands of developers - to Cloudsmith’s cloud-native, massive-scale platform.

That kind of growth attracts investor attention. Software is the lifeblood of every company in every industry. Writing better, more secure software, and deploying it to production faster, is a massive competitive advantage. Having a bulletproof artifact management platform to power your software supply chain delivers that advantage. I’m grateful to our partners at TCV and Insight for believing in Cloudsmith as the company to provide that platform, and welcome 

Fundraising is an exciting, emotional roller coaster. It’s easy to get distracted. But we have serious work to do. It’s on us - the team here at Cloudsmith - to live up to our promises to our customers and the market. To deliver even deeper support for all popular formats across languages, operating system libraries, and containers. To provide a bridge between the CISO’s vision for security, and the VP Engineering’s need for developer efficiency. To scale up the Cloudsmith platform so we continue to be the fastest and most reliable solution on the market. To address a wider variety of deployment use cases. To make it easier to verify the provenance of artifacts that make it into your software supply chain.

 that we’d expand our customer success organization to deliver world-class onboarding services; we’d invest in engineering and innovation; and we’d expand our global footprint. We’ve done all of that and more. We’ll keep investing in our customers’ success. We want software developers to have a delightful experience selecting open-source packages. We want platform engineering teams to rely on Cloudsmith as a trusted partner in building software. We want cybersecurity professionals to lean on Cloudsmith as their key tool for implementing software usage policies.

Thank you to our investors, Cloudsmithers, and, most importantly, our customers for powering the Cloudsmith journey. Onward!

What Cloudsmith’s Series B Means for Our Customers

1 year ago today, I became a Cloudsmither. I joined this incredible company that 

 co-founded because we have an incredible product, built for a massive market, and we were really just getting started.

, the blog stands up as a solid argument for Cloudsmith. We’re displacing legacy artifact management vendors, winning some of their largest enterprise customers with full-scale replacements across hundreds of teams with thousands of developers.

As I approached my 1-year anniversary, I asked myself what 

 makes Cloudsmith special. I landed on three particular qualities of our personality that I think are ultimately the winning qualities that will make Cloudsmith a truly great and historic company.

. Cloudsmith has been multi-tenant software-as-a-service (SaaS) from the first lines of code Lee wrote back in 2016. When your native language is cloud SaaS, you solve a different class of problems. You’re constantly optimizing for throughput, performance, and uptime. Internally, our engineers refer to the company as “Cachesmith.” I love that.

Of course, that means that when we add new edge servers, or find a clever way to serve packages, or rebuild indexes, or redistribute worker queues, or improve EFS throughput, our entire customer base benefits. Our small and mid-size customers get the same performance boost as our largest enterprise customers. Without requiring an upgrade, or a maintenance window. SaaS has been the standard in many corners of the software world for the past decade or more, but it’s still relatively rare for artifact management, in part due to sheer scale - we’re moving around data volumes measured in petabytes, after all.

Cloudsmith is constantly thinking about how to make our global package delivery network faster and more reliable, so our customers don’t have to worry about it. Our massive cloud infrastructure is a big barrier to entry; it’d be hard for a startup to compete with us anytime soon. It’s also hard for any single team, at even the largest enterprise, to compete with our level of scale and global reach. By depending on Cloudsmith to power their artifact repositories, our customers get to focus on building their own great software.

. We really care about the internals of all the different package managers. We get excited about trends across the public open-source registries. We keep up on the latest advances in security scanning, provenance, and developer-native distribution. We obsess over how our customers can make their build pipeline more efficient and how we can make it easier to migrate tools to Cloudsmith. We’re giddy about ways to stream more real-time data to our customers’ reporting and analytics tools.

. That’s another way of saying we’re customer-focused, but at Cloudsmith that manifests itself as truly proactive support. We love finding and fixing problems before our customers are even aware of them. When you build a culture that rewards the kind of intellectual curiosity I’ve described here, you’re able to run faster. Sure, we have distinct roles for our customer support engineers and our product engineers. But when a customer issue pops up in our monitoring systems, we swarm the problem. This is true DevOps—our engineering team stays close to the runtime. It’s another aspect of SaaS that legacy on-premise single-instance software companies just can’t compete with.

Cloudsmith solves a boring problem. For our core customer persona—platform engineering teams—boring is good. Platform engineering is responsible to their developer teams for getting packages where they need to go. We do this for our customers, so we’ve solved a really specific pain. Business school 101—focus on what differentiates you; outsource the rest.

 every day. Thank you to Lee and Alan for embracing me, empowering me to lead Cloudsmith, and allowing us to act as a united leadership team. And thank you to all of our customers for your trust and loyalty. We’ll do everything we can to continue to earn them. I’m always open to your feedback: 

What Makes Cloudsmith Special: Reflections on 1 Year as CEO

Cloudsmith loves open-source software (OSS). There, I said it.

Our co-founders, Alan Carson and Lee Skillen, recognized from the beginning that smart reuse is a core value of the software community. Companies that make developer tools have a special obligation to support OSS, which in the case of Cloudsmith means 

 (OpenSSF). It also means giving back to the community by hosting OSS repositories, and providing distribution capabilities.

 is one of our earliest and most popular features. Any Cloudsmith user - even those on our free Core plan - can create OSS repositories, which we track separately from your public or private repos. OSS repos get 50GB of storage and 200GB of monthly bandwidth for free, as long as you attribute Cloudsmith in your readme. (There are a 

 - specifically, client logging and geo/IP controls - to every OSS repo hosted by Cloudsmith. We recognized that OSS maintainers need these controls, especially as their libraries gain popularity.

 is a wake-up call for software companies. Most commercial software products are built on top of mountains of OSS; and by some estimates, up to 90% of all deployed production code is sourced from an OSS library. There are legitimate questions being asked today about whether commercial entities are doing enough to support the development and maintenance of the OSS that we all rely upon, and ultimately need to trust.

Cloudsmith is a foundational tool in protecting and securing the software supply chain. Organizations large and small use Cloudsmith to ensure they can have a single source of truth, and control the flow of every software ingredient that ultimately lands on their production servers and client devices. The explosion in OSS has demonstrated the need for security-oriented tools like Cloudsmith. While we help customers protect against vulnerabilities that can sneak into OSS, we also believe it’s part of our mission to support healthy development and distribution of OSS.

Like the headline on this blog says - Cloudsmith ♥ OSS.

Cloudsmith ♥ OSS

Securing Excellence: A Personal Perspective from Victor Suarez, IT Operations Manager

As the IT Operations Manager at Cloudsmith, it gives me immense pleasure to share the exciting news that we have successfully completed our surveillance audit for ISO 27001:2013. This global standard for Information Security Management Systems (ISMS) has been a cornerstone of our commitment to security, and I'm thrilled to provide a personal perspective on this achievement.

The road to ISO 27001:2013 recertification was not just a routine audit; it was a journey fueled by our collective dedication to elevating our security standards. Embarking on what we fondly called the "Year of Security" in 2021, the entire Cloudsmith team worked tirelessly to ensure that our security practices aligned with the highest international standards.

ISO 27001:2013 is not just a certification; it's a testament to our commitment to you, our valued customers. It signifies that we have implemented a comprehensive framework that goes beyond IT, covering every aspect of our organisation - people, processes, and controls. Your data's security is our top priority, and this recertification is the proof of our unwavering dedication to ensuring its integrity and privacy.

In essence, ISO 27001:2013 is the gold standard, and obtaining certification is not just a validation of our existing practices but an acknowledgment of our continuous efforts to enhance our security posture. It's about instilling confidence in you, our customers, that when we say we take security seriously, we mean it.

I want to express my gratitude to the entire Cloudsmith team for their hard work and commitment throughout this journey. Achieving ISO 27001:2013 is a collective triumph, and I am proud to be a part of a team that values security excellence.

As we step into the future, rest assured that Cloudsmith remains steadfast in its pursuit of security excellence. We are not merely meeting standards; we are setting new benchmarks to ensure that your trust in us is always well-placed.

I'm genuinely excited about what this achievement represents - a fortified commitment to security, a collaborative effort, and a promise to continue exceeding your expectations. Thank you for entrusting us with your data security, and we look forward to delivering even greater security excellence in the years to come.

Cloudsmith Achieves ISO 27001:2013 Recertification

. In that time, I’ve learned a lot from our customers that I’d like to share.

The world needs a SaaS artifact management platform. 

Large software development teams want and need Cloudsmith. We’re the only enterprise-scale multi-tenant SaaS alternative to the two main products that have dominated market share over the past decade - JFrog Artifactory and Sonatype Nexus. Many of our customers and prospects tell us they’re anxious to switch to a cloud-native SaaS backbone that's inherently multi-tenant, where the vendor (that's us) manages one massive-scale instance that serves all customers.

There’s a real market for well-built, developer-friendly artifact management tooling.

 Our competitors are building horizontally. They’re adding native tools for things like CI/CD and security scanning. We fundamentally believe differently. We think developers want to use best-of-breed DevOps tools from vendors like Harness, CircleCI, Snyk, and Chainguard, rather than be pushed into accepting versions of these tools from their artifact management vendor. So we focus on integrating with, rather than competing against, the most innovative companies in the DevOps ecosystem. And we can do this better, because we’re SaaS.

Better artifact management is at the core of software supply chain security. So we’re laser-focused on building a truly great artifact management platform. One that developers and DevOps teams love. That’s built to work at web scale, without the infrastructure hassles. And we’re finding that developers agree!

The early appeal of Artifactory and Nexus was to provide a local copy of artifacts, just in case the original source was temporarily unavailable. That was a “nice to have,” but artifact management has morphed into a “must-have.” I’m seeing four key trends driving the elevation of this requirement -

The explosion in use of open-source software (OSS) as ingredients in the software supply chain. Where developers 10+ years ago might have used a few OSS packages here and there, today OSS makes up as much as 90% of all deployed code in production.

The rapidly growing threat environment in popular OSS registries like npm (Javascript), pypi (Python), Maven Central (Java), NuGet (.NET), and Docker Hub. Malware and other vulnerabilities are lurking all across these indexes, and the bad guys are getting smarter and more aggressive.

The rise of containerization, along with the ubiquitous use of publicly-sourced containers as building blocks.

The recognition of the need to methodically structure and control the software supply chain, leading to standards like Supply-chain Levels for Software Artifacts (

) and Secure Supply Chain Consumption Framework (

Developer-native software distribution is a game-changer.

 Many of our largest customers rely on Cloudsmith to deliver free and paid versions of their own SDKs and packages, relying on a combination of Cloudsmith repos, our global package delivery network, and our entitlement tokens to gate and monitor downloads. Our capabilities here go well beyond what’s available from traditional artifact management vendors, and it’s a natural extension of our platform since we’re already cloud-native SaaS.

“Me-too” artifact managers are nice, but you quickly outgrow them.

 We’ve seen the hyperscalers and source code platforms release their own artifact managers in recent years. But we’re finding their ambition and feature breadth to be more suited to small teams, rather than the enterprise-scale development teams Cloudsmith is built for. Using a hyperscaler-native tool like AWS CodeArtifact may be a good way to get started, but limited format support, analytics options, vulnerability scanning, and customizability seems to quickly push dev teams to look for more dedicated artifact management tools like Cloudsmith.

We’re committed to doing one thing - being the world’s software supply chain - and doing it incredibly well. 

A CEO’s Reflections: 6 Months In

As the "new guy" here at Cloudsmith (I was named CEO in August), I'm learning more every day about how customers use us to protect their software supply chains. We're doing everything we can to give you a single source of truth for every artifact - whether it's an open source package, a Docker container, a Linux image - that enters your software supply chain, and everything that you produce on the other side.

Turns out this is a massive challenge for most software organizations. When developers pull packages from public indexes like npm, pypi, Maven Central, or NuGet, they may be introducing known vulnerabilities into builds, or using code that's no longer actively maintained. It's hard to track and control what's coming in, and what's been permitted to be deployed to your production systems. The bad guys have discovered that the software supply chain has soft spots that can be used to introduce malware.

Cloudsmithers are dedicated to helping DevOps teams manage this end-to-end flow. Our flagship product, Cloudsmith, made great strides in 2023 towards providing a comprehensive solution that lets you keep an eye on every bit & byte that comes in or goes out. Here's a little visual summary of all we've achieved together in 2023:

, meaning that we'll automatically pull and scan these artifacts from public sources when they're available, so you don't have to manually load them into your Cloudsmith repositories

 by optimizing how we handle Docker layer de-duplication

 to give you more options to automate your pipelines

 to help you find the best packages for your project

And we did it all while maintaining a 97.5% customer support satisfaction score!

And we're just getting started. 2024 will be an even bigger year for Cloudsmith and our ecosystem. We saw a 48% increase this year in overall package download volumes, so we know how much you're counting on Cloudsmith to keep your builds safe and performant. So we promise our customers that we'll deliver more features and support that you need to take control of your software supply chains.

THANK YOU CLOUDSMITH CUSTOMERS!! Tell me how we're doing, or what you need from us in 2024 - 

And if you want to try out Cloudsmith, play around with your personal dev projects to get a feel for how it works, or use us to manage and distribute your open source project - get started at 

. (It's free for up to 0.5GB of storage and 1GB of bandwidth per month for personal use, or 

50GB of storage and 200GB of bandwidth for open-source projects

How Cloudsmith Helped Protect the Software Supply Chain in 2023

This week, we announced that Cloudsmith has taken an impressive $11M in additional funding, hot on the heels of our $15M Series A two years ago. That's not just serious cash for a startup; it's a game-changer! The natural questions are: why did we take it, and what's our big-picture plan?

Here's the why: Cloudsmith isn't just a proven, enterprise-class artifact management platform; we're a market disruptor. We've consistently outperformed and replaced legacy products like JFrog's Artifactory and Sonatype's Nexus, becoming the go-to choice for large organizations with hundreds of developers. We're not just playing in the big leagues; we're setting the pace.

I've seen this movie before. A SaaS upstart challenges a market burdened by outdated, on-premise software. And SaaS inevitably wins out. It's not a matter of if but when. Companies don't switch off systems like JFrog on a whim, but when they realize it's time to refresh, they will look for something authentic, fresh, and modern. That's Cloudsmith.

We're driven by a sense of urgency to ensure Cloudsmith not just competes but dominates these market takeovers. This means offering a comprehensive, unmatched feature set and amplifying our presence with bold sales and marketing. We're not just waiting to be noticed; we're making sure we're the obvious choice, especially for customers upgrading from JFrog or Sonatype.

And here's the plan: we did a leadership exercise to craft a strategy to turbocharge our growth. It's about scaling up significantly in a few critical areas.

A powerhouse engineering team to enhance package format support, innovate, and develop next-gen products and features.

An aggressive marketing campaign to tell developers, DevOps teams, and CISOs why we're the superior choice over JFrog and Sonatype. We're not just part of the conversation; we're leading it.

An expanded customer success organization with tools for seamless migration and integration, reinforcing our commitment to our users and helping them to make the change.

We further cement our global footprint by expanding our tools, teams, and technologies in North America, Europe, and Asia.

Here at Cloudsmith, we've built something extraordinary. Our calling is to simplify the lives of software developers. We're passionate about making our customers' work and lives easier, more productive, and, frankly, more enjoyable with our platform. We're proud of our product; we're revolutionizing software artifact management and distribution.

We're immensely grateful for our investors' faith in us, especially in a challenging VC funding environment. Like our customers, they don't just believe in Cloudsmith; they're betting on our vision to redefine the industry. For everyone who's reading, I invite you to join us on this journey; share your ideas at 

You Took HOW Much Money?!?

When a headhunter reached out to me about the CEO role at Cloudsmith (where I started in August!), one of the first things I did was sign up for a trial account. The product's depth and sophistication really impressed me, and contributed to my decision to go ahead with the interviews. (Glad I did.)

But after I started, I found out that my fellow Cloudsmithers actually thought the experience we offer - especially through the web browser (at https://cloudsmith.io) - was in need of a fresh coat of paint. They were right; our web interface is still largely a Django web app, tightly coupled to the back end, and you can see the Bootstrap showing everywhere. Not much has changed about our web app since Cloudsmith's early days, except for piling on more features.

It's a good time to re-examine the way customers use our web product. Honestly, the current UI is a little too much "let's throw everything at the user, and they can figure out what to configure." Instead, we should be guiding users through a coherent experience, using all the knowledge we have in our platform. Right now we're burying important information that to a seasoned Cloudsmither might seem merely interesting, but is actually critical for customers to get the most out of our tools.

Our default stance for Cloudsmith.io is to put the customer's experience first - and to value your time as a precious commodity. We're starting to think of Cloudsmith.io as not just a front end to our internals, but a critical product in its own right. The web experience needs to nurture new trial users, nudging them towards the fastest and best ways to get value. Things like setting up your first repo. Connecting your first upstream. Firing off your first downloads into a build. Setting up other users with the right permissions. All of this needs to be much easier than it is today. Even for experienced customers, there's more we can do to help you be more secure, more productive, and more in control of your software IP.

So, we've launched a project to basically rewrite 

 Well, a lot of it, anyway. I've seen the initial prototypes, and they're impressive. It's a cleaner look, and it's designed 100% for developer productivity.

We're still several months away from launching, but I'd like to invite customers and supporters to get in touch for a first look. If you're interested in trying the new cloudsmith.io, and you'd like to give us some feedback, shoot me an email today at 

. When it's ready, I'll send you a link. I hope you like the results.

Re-Imagining Cloudsmith.io

 named me publicly as their new CEO. I’m joining 

, the co-founders of Cloudsmith, in building the world’s most powerful software supply chain platform.

The transition has actually been underway since I came to Cloudsmith’s HQ here in Belfast, Northern Ireland, on August 21. I’ve spent the past month meeting Cloudsmithers, our customers, and our investors. I’ve also 

, why he and Lee created the company, and what problems we’re solving for customers.

I’ve just spent the last four years as Chief Customer Officer at 

, where we served a network of millions of software developers with a broad set of communications APIs. Cloudsmith is also “by developers, for developers.” I first learned about version control systems and makefiles in the late 1990’s, but building and deploying software has become incredibly complex over the past few decades. Developers now need to master a deep stack of dependencies, and most of the bits we actually deploy are sourced from third-party libraries and other external artifacts.

Building and distributing software artifacts is core to the task of building software, and it warrants its own management control layer. Software organizations need a central approach for sourcing packages and containers from the likes of npm (JavaScript), pypi (Python), Maven Central (Java), and DockerHub (Docker), combining them with homegrown code, and distributing the resulting artifacts - which may themselves be packages or containers - to internal or external customers.

Using Cloudsmith as your software supply chain platform - controlling what comes in, and what goes out - gives you a place to plug in observability, security scanning, license checking, performance monitoring, and other value-added services to your CI/CD pipelines. And it allows you to distribute your software artifacts in a way that’s native to the developers that are consuming them - in their own CI/CD pipelines - and it lets you track and control that distribution.

This is actually not a new market. Competitors like JFrog’s Artifactory and Sonatype’s Nexus have provided artifact management for over a decade. But these legacy tools, which started out as on-premise and still today have a one-instance-per-customer model, were built for the pre-cloud generation. , Cloudsmith is the only player in the space that’s built from the ground up as a massive scale, multi-tenant Software as a Service (SaaS). This is a big reason I’ve chosen to join Cloudsmith. At 

, a startup I co-founded in 2006, we made a series of three bets that paid off in helping us build a great company - that Salesforce would displace Siebel in CRM, that Gmail would displace Exchange in corporate email, and that Workday would displace Peoplesoft in HRMS. In each case, despite serving customers increasingly poorly, the entrenched incumbent was the safe, de facto choice for most companies. But in each case, a new company built on the SaaS business model became the new standard - first slowly, then all at once, within a few years.

Cloudsmith is the next great SaaS platform that will displace seemingly comfortable incumbents that are built on yesterday’s outdated business model. We’re delivering global scale to our customers, and we’re innovating faster.

, along with a set of strong company values. I love that we are born and bred as a Northern Ireland company. I love that we are already serving an amazing set of software organizations like those at Shopify, VMware, StackOverflow, EnterpriseDB, Carta, and hundreds of others. I love that we are making the lives of software developers easier. I feel at home at Cloudsmith.

If your software organization is still running an on-premise (or “hosted”) legacy artifact management platform, or if you’re deploying production software that’s built by pulling directly from public software package indexes, or if you’re distributing your software in the form of packages to your customers’ software orgs, then 

. You’ll get a fully-featured trial edition to play with. If you REALLY want to talk to a salesperson, we have those too :) Or just contact me directly - I’d love to hear how it’s going.

A special thank you to two inspirational CEOs, 

 at Tercera, for showing me how to do the job right. I hope I can live up to their standards! And thank you to Alan, Lee, and all the Cloudsmithers for the warm welcome and the awesome onboarding thus far!

Cloudsmith Blog