By submitting this form, you agree to our 

This blog contains the takeaways from our webinar "State of the Union: Modern security approaches for the Software Supply Chain." Watch the full discussion 

. Key topics include how to secure your CI/CD pipeline and software artifacts using SBOMs, Docker Hardened Images, and artifact lifecycle best practices.

Software supply chain attacks are on the rise, prompting a critical shift in how we secure modern software. Recent incidents like SolarWinds, XZ Utils, and Log4Shell underscore the urgent need for stronger security measures beyond just protecting production systems. Attackers are now targeting earlier stages of the supply chain, particularly build pipelines, impacting software integrity before it even reaches deployment.

State of the Union: Modern security approaches for the Software Supply Chain

 we brought together industry experts to tackle these challenges head-on. Michael Donovan, VP of Product at Docker, Ralph McTeggart, Principal Engineer at Cloudsmith, and Jack Gibson, Senior Software Engineer at Cloudsmith, shared their insights on how leading teams can defend themselves. During the session, they explored the evolving threat landscape, outlined a secure artifact lifecycle, and discussed strategies such as SBOMs to inject visibility, provenance, and trust into workflows without creating developer friction. While the focus was on container images, the principles discussed were equally applicable to other formats.

Rethinking Software Supply Chain Security

Software supply chain attacks have grown dramatically in both frequency and impact, prompting a fundamental shift in how software is secured. Incidents like SolarWinds, the XZ Utils backdoor attempt, and Log4Shell illustrate a sobering truth: attackers are now aiming upstream. Rather than targeting production systems directly, modern threats exploit vulnerabilities during the software build and integration phases, where visibility and control are often weakest.

As this attack surface expands, it’s no longer enough to harden runtime environments or secure production endpoints. The entire artifact lifecycle - from development to deployment - must be secured. This shift has led organizations to reassess their tooling, processes, and practices around software composition, packaging, and distribution.

The Shift in Emphasis on Software Supply Chain Security

The strategic focus of software security has moved upstream. Major breaches have shown how attackers exploit weaknesses in CI/CD pipelines, source code repositories, and registry infrastructure, areas traditionally outside the purview of security teams.

Events like the SolarWinds compromise in 2020, which leveraged a poisoned build system, or the 2024 XZ Utils incident, where malicious code was inserted by a fake maintainer, underscore how early-stage compromises can lead to widespread downstream impacts. Similarly, Log4Shell revealed the global exposure caused by a single vulnerable dependency, forcing organizations to redirect substantial resources just to locate and patch affected systems.

In response, governments and regulatory bodies have escalated their focus on software supply chain security (SSCS). Executive directives, such as the U.S. Cybersecurity Executive Order, FedRAMP requirements, the EU’s NIS2 directive, and the forthcoming Cyber Resilience Act, demand secure development practices, transparent artifact composition, and provable software provenance.

As attacks increasingly originate at the source, securing the artifact lifecycle is now a foundational requirement - not a future goal.

Modern software development is built around composability and speed. Applications today rely heavily on third-party libraries and frameworks, with open-source components making up as much as 75% or more of a typical codebase. The prevalence of transitive dependencies - indirect libraries brought in through direct ones - adds complexity and opacity to risk assessment.

At the same time, the efficiency of CI/CD pipelines can leave little room for traditional gatekeeping. Code is integrated, tested, and deployed rapidly, often using packages pulled directly from public registries with minimal verification. Unsigned artifacts, missing provenance data, and outdated registry configurations persist across many organizations.

This environment creates ideal conditions for silent, hard-to-detect supply chain threats. In response, software teams must move toward practices that ensure transparency, verification, and control at every phase of the build and release cycle.

Using SBOMs and Establishing Provenance

A foundational step in securing the software supply chain is understanding exactly what is being built and shipped. This is where three elements play a critical role:

SBOMs (Software Bills of Materials): These list all components within a software artifact - names, versions, authors, licenses, and dependency relationships. Tools such as Syft and Trivy support SBOM generation in SPDX and CycloneDX formats. Docker supports SBOMs natively through the docker sbom command. Cloudsmith accepts external SBOM uploads or can auto-generate CycloneDX SBOMs for container images, exposing them via API for automation and policy enforcement.

Digital Signatures: A signature confirms that an artifact originated from a known and trusted source. Tools like Cosign allow developers to sign and verify containers. Signed images enable downstream consumers to confirm authenticity before deployment.

Provenance: Provenance data describes the origin of a build, including input sources, build parameters, and environments. Docker Buildx supports automated provenance generation using the --provenance flag, capturing crucial metadata such as build arguments and platforms.

Together, these elements create an auditable trail of software origin and composition. In regulatory contexts, SBOMs are now a standard requirement. But beyond compliance, they provide security teams with the ability to trace vulnerabilities to specific packages, drastically reducing remediation time and effort. Cloudsmith’s Enterprise Policy Management (EPM) leverages SBOM metadata for automated policy actions, such as quarantining risky images or enforcing license compliance based on live dependency data

Tightening Security with Docker Hardened Images

As organizations grapple with securing sprawling software pipelines, Docker Hardened Images (DHIs) offer a straightforward way to integrate trusted, verifiable container artifacts into modern workflows, without slowing down development.

Available on Docker Hub, DHIs are a curated set of container images designed to minimize vulnerabilities out of the box. They are built with a smaller attack surface, and include a full suite of embedded security metadata by default. This makes them ideal for teams looking to adopt zero-trust practices without adding complexity or friction.

VEX (Vulnerability Exploitability eXchange) metadata

These attestations provide comprehensive visibility into the contents and origin of each image. Because they are packaged directly with the artifact, they integrate seamlessly into downstream platforms like Cloudsmith or any private registry. This removes the burden of generating and attaching this metadata later in the pipeline.

The impact is significant: DHIs can reduce vulnerabilities in base images by as much as 95%, offering a hardened starting point for secure application builds. Just as importantly, they help teams meet compliance and audit requirements from day one, with verifiable transparency and traceability.

By building security directly into the image and surfacing critical metadata in machine-readable formats, Docker Hardened Images simplify the process of building secure containers—and make modern supply chain security accessible by default.

Building a Secure Artifact Lifecycle

A secure software supply chain requires continuous validation from development through delivery. This is where centralized artifact management platforms like Cloudsmith become essential.

By configuring repositories to proxy public registries (e.g., Docker Hub, NPM, PyPI), Cloudsmith performs key security checks automatically:

Artifacts are cached and versioned, offering security and development teams full visibility and control over dependencies. When an image is pulled, verification steps - including signature checks and attestation validation - ensure that only known, trusted, and reproducible software is admitted into builds or deployments.

However, the ecosystem still faces gaps. Many widely used packages, particularly in NPM and PyPI, lack signatures or attestations. As of late 2024, only 5% of the top 360 packages on PyPI had provenance data published through the trusted publisher workflow. This makes it difficult to assert origin or integrity for many upstream dependencies.

To address this, teams should introduce a secure intermediary - like Cloudsmith - between developers and public sources. This provides enforcement points for policy, visibility into dependencies, and the opportunity to filter and block unverified packages before they can compromise the build.

Once builds are finalized, signing them and recording those signatures in transparency logs (e.g., Sigstore’s Rekor) ensures traceability and trust. This final step solidifies confidence that artifacts were not tampered with before reaching production.

Security features must be accessible, automated, and non-disruptive to gain widespread adoption. Teams are more likely to maintain best practices when secure workflows mirror familiar development patterns.

 come pre-equipped with SBOMs, digital signatures, and SLSA-compliant provenance. These attributes allow teams to build secure pipelines without requiring additional tooling or custom scripting.

When paired with Cloudsmith, this enables organizations to:

Centrally manage and enforce policies on all artifacts

Control access and visibility across engineering teams

Integrate security checks without altering development velocity

The result is a zero-trust pipeline where software integrity is maintained automatically, and security is treated as a first-class concern throughout the SDLC.

The shift towards modern security approaches is undeniable. SBOMs, signatures, and attestations are becoming fundamental elements in software development. The impending legislation, particularly in the EU with the Cyber Resilience Act, will further mandate these practices.

For a deeper dive into securing your container workflows, check out our companion blog post, "

Securing Containers at Scale: Docker Hardened Images and Cloudsmith

Maia Livingstone

Campaign Manager

Ian Taylor

Tech Content Director

Jack Gibson

Senior Software Engineer

Docker Hardened Images & Cloudsmith: Modern Security for the Software Supply Chain

Enterprises should prioritize securing their software artifacts to protect intellectual property (IP), maintain compliance, and mitigate supply chain risks. A strong security posture requires a deep understanding of access management, distribution controls, compliance enforcement, and software lifecycle governance.

This guide explores key principles of software security and best practices that enterprises can adopt to ensure software remains protected from unauthorized access, compliance violations, and supply chain threats.

Implementing Enterprise-Level Access Control

Effective access management is the foundation of software security. Enterprises should:

Adopt Role-Based Access Control (RBAC) to define and enforce access policies at a granular level.

Leverage Single Sign-On (SSO) via SAML to streamline authentication and centralize user identity management.

Use SCIM integration to automate user provisioning and deprovisioning, ensuring timely access adjustments.

Establish structured team and service account management to prevent unnecessary access and privilege escalation.

By implementing these controls, organizations ensure that only authorized personnel interact with software artifacts, reducing security risks and enforcing least privilege access.

Controlling Software Distribution with Entitlement Management

For enterprises distributing software externally, precise access control is essential. Best practices include:

Using entitlement tokens to grant controlled, read-only access at an individual package level.

Monitoring and tracking software downloads to maintain visibility over usage.

Revoking or modifying access as needed to comply with licensing terms and security policies.

These techniques help organizations manage software distribution securely while maintaining complete visibility into how assets are accessed and used.

Meeting Compliance and Location-Based Security Requirements

Global enterprises must align software storage and access with compliance requirements. To do so, they should:

Enforce Geo/IP restrictions to control where software can be accessed.

Utilize custom storage regions to align with regional data sovereignty and regulatory requirements.

These measures ensure enterprises maintain compliance with industry regulations while safeguarding sensitive data.

Auditing, Tracking, and Managing the Software Lifecycle

Visibility and traceability are critical to software security. Enterprises can enhance security by:

Maintaining client logs to track software access and detect unusual activity.

Implementing audit logs to track administrative and operational changes.

Defining retention and lifecycle rules to automatically archive or remove outdated software artifacts.

With continuous monitoring, organizations can quickly detect and respond to potential security threats while streamlining compliance reporting.

Ensuring Secure Software Promotion and Delivery

To maintain a secure software pipeline, organizations should:

Implement package promotion workflows to control how software transitions from development to staging and production.

Establish provenance tracking to maintain an immutable record of software lineage.

Enforce security policies that verify software integrity before deployment.

By embedding these security measures into the software development lifecycle, enterprises can reduce risks and ensure that only trusted, verified software is deployed to production environments.

Adopting a Zero Trust Approach to Software Security

A Zero Trust security model - where no entity is trusted by default - helps organizations maintain security across their software supply chain. By focusing on robust access controls, entitlement-based distribution, compliance enforcement, and continuous monitoring, enterprises can strengthen their security posture while maintaining the agility to innovate and scale.

By mastering these security principles and leveraging the right tools, organizations can take full control of their software IP, ensuring that their most valuable digital assets remain secure, compliant, and resilient against evolving threats.

For enterprises seeking a comprehensive solution to manage and secure their software artifacts, Cloudsmith offers a universal, cloud-native platform designed to meet these needs. With features such as role-based access control, entitlement management, compliance enforcement, and advanced observability, Cloudsmith empowers organizations to implement robust security measures across their software supply chain. To learn more about how Cloudsmith can enhance your software security strategy, 

Enterprise-Grade Software Security: Mastering Control Over Your Software IP

Continuous Integration and Continuous Deployment (CI/CD) pipelines power modern DevOps. They enable teams to deliver software faster, with greater reliability and confidence. However, as development accelerates, ensuring security, compliance, and quality becomes increasingly complex. Automated policy checks streamline CI/CD pipelines by addressing these challenges directly.

Enhanced SecurityManual reviews are error-prone and inconsistent. Automated policy checks enforce security protocols reliably, vetting builds, dependencies, and code changes against predefined standards. Cloudsmith provides a centralized platform to manage these policies, ensuring that every artifact and package meets compliance requirements before entering your pipeline.

 Secure and Compliant Software Delivery with Cloudsmith Policy Management

 explains how policy management features enable security and compliance enforcement.

Regulatory ComplianceStrict compliance requirements in industries like finance, healthcare, and government demand precision. Automated checks ensure releases meet regulatory standards, minimizing the risk of fines or breaches. These compliance expectations are rapidly becoming industry-wide best practices, meaning all organizations - not just regulated industries - should adopt robust security and compliance policies. 

Using Cloudsmith as a Dependency Firewall

 highlights the importance of controlling package consumption to ensure compliance.

Increased EfficiencyManual interventions slow pipelines and create bottlenecks. While some teams may still manually review or approve changes, this approach is unsustainable at scale. Automated checks provide real-time feedback, accelerating delivery cycles while maintaining governance. The 

6 Essential Features for Your Next Artifact Manager

 blog outlines crucial capabilities that improve efficiency.

Reduced RiskBy identifying vulnerabilities, misconfigurations, and compliance issues early, automated policy checks lower the chance of deploying faulty code. Policies managed at the artifact level - such as those provided by Cloudsmith - ensure that only secure, compliant assets enter production.

Dependencies often introduce vulnerabilities. Automated tools analyze dependencies for security risks, license compliance, and outdated versions, blocking risky packages from production. Cloudsmith natively integrates these checks within its artifact management platform, offering an additional layer of security beyond CI/CD pipeline-level scans.

Automated gates ensure new code meets quality standards, such as code coverage and complexity thresholds. While tools like SonarQube enforce these rules at the CI/CD level, policy management at the artifact level ensures only vetted packages are distributed downstream.

IaC tools, such as Terraform and CloudFormation, benefit from automated validation. These checks catch misconfigurations and enforce deployment best practices before infrastructure changes are applied. The 

Enforce Secure Automated Deployment Practices through IaC

 webinar explores how policy enforcement in IaC can improve security.

Teams using containers can automate image scans to flag vulnerabilities or misconfigurations before deployment. Cloudsmith helps enforce security and compliance policies at the artifact level, ensuring only approved container images are used in production.

Automated policies control deployment conditions, such as requiring approvals for production releases or enforcing restrictions on specific environments. Centralized artifact management allows organizations to implement stricter governance beyond what is possible within a CI/CD pipeline alone.

Implementing Automated Policy Checks in CI/CD Pipelines

Select tools that integrate seamlessly with your existing CI/CD pipeline. A combination of CI/CD-based policy enforcement and artifact-level policy management, like Cloudsmith, provides a more comprehensive approach.

Collaborate with security, compliance, and engineering teams to create policies aligned with organizational goals. Policies, defined as code, are the future and offer greater power and flexibility compared to rigid, rule-based checks. Using Open Policy Agent (OPA) allows teams to express policies in a declarative, code-based format for better automation and enforcement.

Shift left by implementing policy checks early in the pipeline. This prevents issues from propagating downstream and ensures that security and compliance are addressed from the start.

Use logs, reports, and feedback to refine policies and improve tools regularly. Cloudsmith provides real-time insights into artifact security, compliance, and policy enforcement, helping teams proactively manage risk. 

Consuming Open Source Securely Using S2C2F

 provides guidance on incorporating open-source components securely into CI/CD pipelines.

Automated policy checks are essential for scaling CI/CD pipelines without sacrificing security, compliance, or quality. While CI/CD tools can enforce some policies, centralizing policy enforcement at the artifact management layer with Cloudsmith provides a more holistic and effective approach.

Streamline your CI/CD pipeline today. Learn how Cloudsmith can help automate your policy checks and optimize your DevOps processes. 

Streamlining CI/CD Pipelines with Automated Policy Checks

Managing software artifacts across distributed teams and complex infrastructures securely demands proactive measures. Robust policy management is the best way to ensure compliance in your software supply chain. Cloudsmith, the leading cloud-native package management platform, can streamline policy management and strengthen security. Let’s explore why policy management matters and how we can simplify it for you.

Policy Management is a structured way to define, implement, and enforce rules and guidelines in your software delivery process. Effective policy management:

Enhances Security: Enforces strict access controls and ensures the integrity of your software artifacts, reducing vulnerabilities and minimizing risks.

Ensures Compliance: Helps you adhere to GDPR, HIPAA, SOC 2, and other regulatory frameworks, keeping you audit-ready.

Maintains Consistency: Standardizes workflows across teams, ensuring that everyone operates within established guardrails.

Boosts Efficiency: Automates policy enforcement, reducing manual overhead for approvals and compliance checks.

For a deeper dive into Cloudsmith's approach to enhancing security and compliance through policy management, check out 

Cloudsmith's Enhanced Security with Policy Management

Cloudsmith Policy Management: A Holistic Approach

With Cloudsmith, you take full control of your package repositories with policy management. These make Cloudsmith the ideal choice for teams prioritizing security and compliance:

You set granular permissions for users, teams, and API tokens. Using role-based access control (RBAC), you can:

Assign repository access based on user roles.

Apply least-privilege principles to ensure users access only what they need.

Monitor and audit access logs to detect anomalies.

Learn more about how Cloudsmith supports Zero Trust security principles in 

Implementing Zero Trust Security with Cloudsmith in 5 Steps

Efficient storage management reduces costs and enhances security. Cloudsmith lets you:

 to automatically remove outdated or unused artifacts after a specified time.

Use Disposal Policies to securely delete artifacts while maintaining an audit trail, ensuring data governance compliance.

Controlling where your data can be stored or accessed is a crucial part of many compliance frameworks. Cloudsmith supports geo-restriction policies, allowing you to:

Restrict repository access based on geographic regions.

Check out how Cloudsmith has helped organizations like SaaS providers comply with GDPR and data residency requirements in our 

 Security Scanning and Vulnerability Policies

To protect your software supply chain, Cloudsmith integrates security scanning directly into the platform. You can:

Block packages with known vulnerabilities.

Automatically notify teams when critical issues are detected.

Licensing compliance is an important part of managing open-source dependencies. With Cloudsmith, you can:

Define acceptable licenses for your projects.

Block artifacts that violate license compliance policies.

Generate reports for audits, ensuring transparency.

Cloudsmith empowers you to automate policy enforcement by integrating with CI/CD pipelines. By embedding policy checks into your workflows, you can:

Automatically validate artifacts against predefined rules.

Prevent deployment of non-compliant artifacts.

Accelerate delivery cycles while ensuring compliance.

To learn how policy enforcement can be integrated into your DevOps workflows, explore 

Kong – Streamlining Artifact Management and Distribution

Kong, a prominent open-source API management platform, required a robust solution to manage and distribute their software artifacts efficiently. By partnering with Cloudsmith, Kong was able to:

Centralize Artifact Storage: Utilize Cloudsmith's universal artifact management to store all their packages in a single, secure location.

Implement Fine-Grained Access Controls: Define and enforce policies that ensure only authorized personnel have access to specific repositories and artifacts.

Enhance Distribution Efficiency: Leverage Cloudsmith's global edge caching to deliver artifacts swiftly to their global user base.

This collaboration resulted in a more streamlined and secure artifact management process, allowing Kong to focus on developing their core products without worrying about the complexities of artifact distribution.

Best Practices for Policy Management in Cloudsmith

Policy management is even more powerful with some planning, collaboration, and continuous improvement. Here are some best practices to help you maximize the value of Cloudsmith policy management:

Your security, compliance, and development teams can establish policies that align with your organization’s goals. Consider these steps:

Identify Key Objectives: Are you looking to adhere to regulatory requirements like SOC 2? Or reduce security vulnerabilities in production?

Collaborate Across Teams: Involve stakeholders from DevOps, security, and legal teams to ensure policies cover access control, licensing, and vulnerability scanning.

Create a Policy Library: Maintain a centralized repository of all approved policies so it’s easy for teams to reference and follow them.

Pro Tip: Use policy templates and the Enterprise Policy Manager to standardize and scale policy creation across multiple teams. Learn more about Cloudsmith's 

Continuous monitoring helps you stay ahead of potential risks and ensure compliance over time. Cloudsmith offers built-in monitoring tools to help you track and report policy adherence. To maximize their effectiveness:

Audit Regularly: Leverage Cloudsmith’s Audit Logs to monitor actions performed by users, systems, and service accounts. This feature provides a complete history, enabling you to identify anomalies and ensure compliance.

Track Key Metrics: Monitor metrics like artifact vulnerability rates, license violations, and geographic access patterns to stay proactive in your security efforts.

Set Alerts: Configure notifications for critical issues, such as non-compliant artifacts or unauthorized access attempts, so your team can respond quickly.

For more details, check out Cloudsmith’s guide to 

By embedding policy checks into your DevOps workflows, you can maintain compliance without slowing down delivery. Here’s how:

Automate Artifact Validation: Use Cloudsmith’s APIs to automatically validate artifacts against predefined policies during your CI/CD pipeline runs.

Prevent Non-Compliant Deployments: Configure your CI/CD tools to block deployments that fail security or compliance checks, ensuring that only approved artifacts make it to production.

Leverage Pipeline Integration: Integrate Cloudsmith with popular CI/CD tools like CircleCI, GitHub Actions, and GitLab to streamline policy enforcement.

For more information on managing package promotion workflows, check out 

How to Manage Your Package Promotion Workflows with Cloudsmith

By automating policy enforcement, your team can accelerate delivery cycles while maintaining security and compliance.

Your policies need to keep pace with change. Regularly reviewing and updating your policies ensures they remain relevant and effective. Follow these best practices:

Schedule Regular Audits: Conduct quarterly policy audits to ensure they align with current regulations and organizational goals.

Adapt to New Threats: Stay informed about emerging vulnerabilities and security risks, updating your policies to address them.

Solicit Feedback: Encourage teams to share their experiences with existing policies and suggest improvements. This collaborative approach fosters a culture of compliance and innovation.

Document Changes: Maintain a change log for your policies to track updates and communicate them effectively across the organization.

Pro Tip: Use Cloudsmith’s reporting features to generate compliance reports that provide valuable insights and help refine your policies over time.

Stay up-to-date with Cloudsmith’s latest features and updates by joining our 

Ready to empower secure and compliant software delivery? Book a 

 with an expert today and see how Cloudsmith transforms your software artifact management.

Secure and Compliant Software Delivery with Cloudsmith Policy Management

2024 was a year of incredible stories. At Cloudsmith, we had the privilege of being part of our customers' journeys as they reached significant milestones, driving growth, innovation, and strengthened trust across the globe. Our customers led the way, leveraging Cloudsmith’s capabilities to enhance their workflows, scale their operations, and secure their software supply chains. Let’s explore the amazing progress our community made together and the stories behind these achievements.

In 2024, our customers embraced the all-new WebApp, a major upgrade designed to make artifact management more intuitive and efficient. This enhanced user experience enabled teams to streamline their operations and focus on delivering value to their customers.

Throughout the year, more and more teams turned to Cloudsmith, resulting in a staggering 53% increase in packages delivered. Each delivery represented a project moving forward, a product getting closer to market, or a team achieving its goals. This growth was a testament to the trust our customers placed in Cloudsmith as their reliable partner in artifact management.

2024 was the year where our customers gained unprecedented control over their software supply chains. With the introduction of Broadcasts and Policy Management, teams were empowered to oversee their operations with greater clarity and precision. These features were catalysts that enabled our customers to work smarter and safer in an ever-evolving digital landscape.

This year, our customers met us at events like KubeCon, GitHub Universe, and SREcon. These weren’t just conferences - they were chances to learn, share, and grow together. Our customers brought their experiences and challenges to the table, and together, we explored new ways to innovate and push the industry forward.

For teams integrating Cloudsmith with tools like Azure DevOps and ArgoCD, 2024 was about making life easier. These integrations weren’t just about technology - they were about creating seamless workflows that allowed teams to focus on their goals, knowing their tools would support them every step of the way.

Throughout the year, our customers’ success was our top priority. With a 96.8% customer support satisfaction rating, every interaction aimed to empower users and solve challenges swiftly. Behind each support ticket resolved was a team able to move forward with confidence, knowing Cloudsmith had their back.

We measure success not only through metrics but also by the impact we've had on our customers' businesses. Here’s what a few of them had to say about their experiences with Cloudsmith in 2024:

“Cloudsmith has significantly simplified our artifact management. By using Cloudsmith, we can easily store and share artifacts across the organization, while also ensuring the security and compliance of every release. It’s been a true partner in our growth.”– Sandy McNeely, Director of DevOps, PagerDuty

“Cloudsmith’s solution has made a noticeable difference in our workflow. We’ve streamlined the way we manage and distribute software artifacts, and the speed and reliability have been key in helping us meet our goals.”– Tom Dillon, Senior VP of Engineering, Diligent

“Using Cloudsmith allowed us to ensure our products were shipped more securely and efficiently. The ability to have fine-grained control over our software supply chain means we can focus on building innovative solutions while Cloudsmith handles the infrastructure.”– Chris Sutherland, CEO & Founder, Humanising Autonomy

Cloudsmith Blog

Docker Hardened Images & Cloudsmith: Modern Security for the Software Supply Chain

Enterprise-Grade Software Security: Mastering Control Over Your Software IP

Streamlining CI/CD Pipelines with Automated Policy Checks

Secure and Compliant Software Delivery with Cloudsmith Policy Management

Cloudsmith 2024: By the Numbers

A Year to Remember: Cloudsmith’s Journey Through 2024 🚀🌍

Thoughts on Datadog’s new Supply-Chain Firewall

Mastering Your JFrog Artifactory Migration: Steps to Success

Securely Store and Distribute OCI Artifacts

Introducing Cloudsmith’s Advanced Observability Suite for Enterprise Artifact Management

Introducing Cloudsmith’s Enterprise Policy Manager

Your Ultimate KubeCon Guide