By submitting this form, you agree to our 

Answer twenty questions about your artifact and supply chain practices. Get a custom report card showing your maturity score against key regulatory and compliance frameworks.

Artifact Security Maturity Assessment

The attack on SolarWinds in December 2020 was a watershed moment: it provided a stark demonstration of how much damage a compromised software supply chain could cause, and a wake-up call for how much trust organizations place in the integrity of the software they depend on. Overnight, everyone learned what a software supply chain was.

Developers spent weeks mitigating the risk. Six years later, attackers are now supercharged by agentic AI’s capabilities, and increasingly going after open source packages. The very dependencies that make modern software possible are also putting it at risk. The scale and magnitude of today’s onslaught, with multiple attacks a day, would have been unimaginable in 2020.

At the same time AI enables attackers to target any company through the software that runs their business, companies are also building more software than ever. The pace of software development has outstripped what any manual review processes could keep up with. Dependency decisions were traditionally made by a human developer, but now those decisions are increasingly made by AI, either by a citizen developer who is vibe coding or by an AI agent whose mission doesn't include keeping your supply chain free of malicious packages and actors.

The usual security model teams have relied on - periodic scanning, resolving issues immediately where possible, backlogging lower-priority issues - can’t keep up with the pace or the style of the attacks we face today. In March 2026, a maintainer account for the popular npm package axios (100M+ weekly downloads) 

, allowing attackers to slip in a malicious dependency carrying a postinstall script that ran the instant npm install was called. A malicious package can compromise a developer's machine or a build pipeline instantly, before the first build. Workflows built to protect production are no longer enough to prevent breaches.

Protecting your entire organization from cyberattacks requires defense in depth. A critical component of keeping software safe is a curated repository. This means a private, controlled repository that manages software artifacts from the point of ingestion, all the way to production.

A curated repository builds a trusted supply chain through knowledge, enforcement, and orchestration

When every pull, every build, and every package request flows through a centralized repository like Cloudsmith, you get one place to control what software enters your supply chain, and how it moves through to production.

The right private, curated repository serves several functions. It:

Covers the packages, formats, and ecosystems your developers use

Inspects packages to understand their composition, while extracting key metadata

Understands where a package is coming from and where it goes

Enriches what’s known about a package to include quality and risk characteristics

Can prevent use of a package based on that knowledge, or until more is known about it

Can govern how a package moves toward production, or whether it's allowed at all

This kind of curated repository becomes the orchestration layer that builds trust in your software supply chain. The way to get it is to use a universal artifact management platform with risk detection and policy built in. 

Provides visibility into where every package comes from

Aggregates insights into package quality and risk

Updates its risk data as new threats emerge

Provides control over how software components move toward production

Policy management and continuous risk detection are now baseline requirements

 capabilities should be considered table stakes for any organization that wants to control and secure its software supply chain.

Write your own logic in Rego, the open source policy language used in the Open Policy Agent (OPA) framework, tailored to your specific security and compliance requirements.

Policies are evaluated on package ingestion, and re-evaluated in real time automatically as policies or threat intelligence changes

 hold new package versions back from clients for a set window of time, so security researchers have a chance to identify malicious releases.

Cloudsmith-recommended policies already written for you, so you don't need to write Rego from scratch.

A full audit trail of every policy evaluation, viewable in the web app and downloadable via API

Because they’re written as code, Cloudsmith policies are incredibly powerful and flexible. You can make decisions based on key attributes of a package, like license information or package age. Cloudsmith's continuous risk detection systems bring security intelligence into the policy layer, so your policies keep up with the latest threat intelligence.

In the Cloudsmith platform, threat detection runs automatically, for every supported package format in your workspace. Cloudsmith refreshes threat intelligence every five minutes, so if a new or updated record affects packages already in your repositories, they’ll be matched automatically. The days of scheduling periodic rescans are over.

To make sure nothing is missed, packages are matched to public security advisories based on a standard identifier called a package URL (PURL). Cloudsmith supports SemVer and ecosystem-native version ranges when matching advisories to specific versions of packages.

A single publicly identified vulnerability may be reported by multiple sources, resulting in duplicate records from different upstream databases. Cloudsmith automatically detects these duplicates, grouping and surfacing one primary record per vulnerability. This results in cleaner data and more focused reviews.

By default, packages are sorted by severity, highest first: Malware, then Critical, High, Medium, Low, and Unknown.


Control your software supply chain without slowing down developers

Over the years, we’ve found that artifact management has historically been the purview of platform engineering teams. These teams traditionally look to centralize critical workflows, to ensure consistent, standard delivery. But we’ve seen a change in the market recently. Security teams are increasingly recognizing that centralizing these workflows enhances security. Cyber security teams can partner with developers by enforcing policies that redirect direct access to public registries to a curated, managed repository that serves as a trusted proxy. Development teams still need to move fast, so enforcement actions that affect a developer's workflow have to be built with the developer experience in mind.

Cloudsmith solves this in a uniquely developer-friendly way. Cloudsmith policies remove bad packages from the index that is presented to package managers. This changes the package version selection process, so that developers get compliant packages the first time, rather than an error message and a broken build. If a specific pinned package version is requested, but that version has been quarantined for security reasons, clear messaging and integrated workflows tell developers why their build failed, and what they can do about it.

A secure software supply chain starts with universal artifact management

We’ve all come a long way since the SolarWinds attack in 2020. We’ve learned how to secure the software supply chain, without slowing down developers. Every package your team requests should pass through curated repositories, where policies tailored to your security and compliance requirements can protect your builds, backed by realtime, always-updated threat intelligence. The artifact management platform serves as the orchestration layer, across every team, pipeline, and AI agent, enforced at the source, automatically.
See how 

Alison Sickelka

VP of Product

Trust your software supply chain from ingestion to production

, with participation from our existing investors, to build the operating system for the modern software supply chain. The timing matters because AI is changing what it means to build software.

We’ve been doing it long enough to see the internet change how we distribute software. We’ve seen open source change how we reuse components. We’ve seen CI/CD change how we build and deploy. We’ve seen cloud change how we run infra. We’ve seen SaaS change how we architect applications.

With each evolution, we expand what developers can achieve and how quickly they can move. We evolve our way of working and the tools we use. AI may be the most consequential evolution yet because it touches every area I just listed.

Developers will always play a central role, even as bots update dependencies, CI/CD systems continuously consume artifacts, agents write code and push changes through systems at a scale that humans can’t manually review at the same pace. Developers know what to build and why, but there’s been a change in the laws of physics for software.

We want developers to move faster. We want teams spending less time fighting infrastructure and more time building things that matter. Our tools must make building software safe, so we trust developers to run at maximum tilt.

Software is becoming easier to create than to trust.

Cloudsmith sits at a critical point in the trust chain. That is why this Series C matters: it gives us the fuel to deliver on that promise at a time when software is becoming easier to create than to trust.

Artifact management was always the control point

When Cloudsmith began, artifact management was still seen as busywork and plumbing - necessary, but boring. You wrote code, pushed packages somewhere, pulled them into another system, and moved on. But Cloudsmith didn’t see it that way.

When you think about how we construct software, source code matters, but really, most software actually exists as “artifacts” - our word for packages, containers, dependencies, metadata, SBOMs, signatures, provenance, and builds.

Artifacts are the threads that connect modern software creation, consumption, governance, and delivery.

Artifact management was seen as repositories, storage, and developer convenience - a place to hold packages. But things have gotten… complicated. The explosion of open-source packages, evolving threats to the software supply chain, and the rise of agentic AI software development have shown that artifacts are, in fact, the critical control point.

Cloudsmithers are true believers. The market has now caught up with that belief.

There were easier ways to build Cloudsmith. But we had the conviction that artifact management is what ultimately mattered most. We chose to focus on the fundamentals: simple by design, secure by default, and genuinely cloud-native. We also chose to build a multi-tenant-only platform that would benefit everyone plugged into it. That was not always the cheapest approach, nor was it always the obvious one. But we believed it was the right one.

Software and AI have entered the age of assembly

Software is assembled far more than it’s authored. We build software by combining ingredients - what developers call “dependencies” - into something useful. The flow of ingredients is what we call the software supply chain. The shift from “write code myself” to “assemble software from components” has been happening for decades; AI agents have accelerated this to a breathtaking scale.

Think of this as the AI software factory - a place where we build pipelines for AI to assemble software. Humans decide what to build and oversee the process. Agents write and change the code. CI/CD systems build and test the components they produce. Partner tools inspect them. Registries and package managers supply additional ingredients. Deployment systems ship the final product.

 that over 1.1 million public repositories import LLM SDKs, with 518 million merged PRs, growing 29% annually. I’m certain that’s accelerated in the past 6 months.

Every dependency use is a trust decision, and every artifact has provenance: where it came from. Every artifact should also have a policy: how it should be used. And every artifact has ownership: who is responsible for it. Because every artifact has a blast radius: what happens if it is vulnerable, malicious, or misconfigured?

These decisions matter, whether you make them explicitly or you just let them happen. We’ve collectively let our guard down when it comes to software supply chain trust, and threat actors know it. Their attacks are increasing, they’re creative and ever-changing, and they’re effective enough that every serious organization has to care.

 in March 2025 affected more than 23,000 code repositories and exposed CI/CD secrets in workflow logs. Axios, one of the npm ecosystem’s most widely used HTTP clients, was 

 (April 2026) through malicious npm releases that deployed a cross-platform Remote Access Trojan (RAT), at a scale of 100 million downloads per week. Those represent huge surface areas of potential impact.

Despite these incidents, we’re going to keep building software using components, and if anything, we’re speeding up. “Don’t use dependencies” isn’t an option. The only viable path is forward - to control the flow of components (we’d say “artifacts” at Cloudsmith).

Automating the control point for the new age

Humans have traditionally been the control surface for the software supply chain. Developers are trained to pull packages from public registries. For example, every Python 101 course teaches “pip install” on the first day, accepting that the default target is PyPI. It’s not until advanced courses (if ever) that developers start asking, “Where exactly do those packages come from, anyway?”

As you assemble teams to build software, you typically add some rigor to dependency management, with manual reviews, metrics, logs, and dashboards. You might already have reactive security scanning that blocks unwanted packages when PRs are merged, at the end of the development process. But that approach no longer scales. To keep up with modern software velocity, teams need automation, along with, by default, machine-enforceable, context-rich guardrails that are fast enough to prevent bottlenecks.

Cloudsmithers are optimistic by nature. We’re not into fear, uncertainty, and doubt. We’re more about clarity, control, and confidence. Clarity means knowing which packages are being used. Control means governing how they move and how they are distributed. Confidence means developers and agents can move fast without breaking trust.

Visibility here matters - we need SBOMs, SCA, and inventory tools to see and understand the software supply chain. But we actually need more than to see the problem space; we need to control it. That’s what makes artifact management so critical to governing the software supply chain.

We say at Cloudsmith that you need visibility to get control, and you need control to get security. Security is ultimately a by-product of strong controls and visibility.

Cloudsmith isn’t an application security tool; we’re infrastructure, and our role in the modern software factory is to serve as the artifact control plane. We sit where software components cross boundaries: from upstreams into the enterprise, from developers into builds, from builds into environments, and beyond. Cloudsmith is where you manage software artifacts, attach metadata, prove provenance, enforce policy, and govern distribution.

Stronger security is a by-product of a stronger underlying control point.

Cloudsmith 2.0: the operating system for the modern software supply chain

Cloudsmith 2.0 is our vision for the operating system of the modern software supply chain. It’s our underlying architecture, and it’s what makes Cloudsmith more than just a registry service for artifacts.

We use the operating system metaphor deliberately because operating systems are foundational. They provide shared primitives and guarantees that make it easier, faster, and safer to build complex systems. The modern software supply chain needs the same thing: artifact identity, metadata, provenance, policy, audit, routing, caching, and delivery, all working together across a global graph of producers, consumers, partners, and ecosystems.

The Cloudsmith 2.0 operating system is built around three core layers:

A record layer that gives you a durable source of truth for artifacts, identity, metadata, and provenance.

A control layer that lets you make fast, enforceable, and auditable decisions.

A delivery layer that distributes software efficiently to your developers, pipelines, and external customers.

Partners can plug data, signals, workflows, and expertise into those layers, while customers build their own software supply chain workflows on top. Together, those layers turn artifact management into a shared data and control plane, where components are governed and delivered at web scale.

Cloudsmith is built for this because we are global, cloud-native, and multi-tenant by design. Our DNA is different from legacy, per-installation, single-tenant registry architecture that dominated the artifact management space before we came along. The Cloudsmith 2.0 operating system means package health intelligence, actionable feedback, data pre-computation, and fast policy decisions compound across the ecosystem.

A big benefit of Cloudsmith 2.0 is that more work can be done in advance. Artifacts are ingested, canonicalized, enriched, stored, and linked before they are requested. Actionable policy decisions happen quickly because the system already has the data. Software delivery is more predictable with a platform built on global routing, caching, and connectivity.

That’s pretty technical, but the outcomes are clear: safer, faster software, at any scale. One signal protects many customers. Each trusted record reduces duplicated work. A unified control plane helps cross-functional, distributed teams make better trust decisions and consume software with the right evidence and controls.

Accelerating Cloudsmith’s vision with partners, investors, and customers

Our Series C financing is fuel for the mission we’ve been on since we started.

We will accelerate Cloudsmith 2.0, with AI-native workflows, stronger software supply chain controls, a deeper automated policy engine, richer provenance and insights, package-aware delivery and connectivity, and more pluggability with partner tools.

Cloudsmith believes in partnerships. Surprisingly, this is still a fairly radical notion in the artifact management market. But we just don’t think any one vendor will supply the definitive scanner, CI/CD pipelines, security data source, and workflow tooling an enterprise needs. The better approach is an open control plane where partners combine their signals, workflows, and expertise into a central software component control point.

“Docker has always been where developers build and ship software, and security has to be the default, not an afterthought. Docker Hardened Images and Docker Hardened System Packages set a new standard for trusted containers. With Cloudsmith, enterprises can manage those hardened components at scale and deliver secure software without friction."

“Cloudsmith has become one of the most important pieces of infrastructure in the modern SDLC - the cloud-native artifact registry that replaces legacy tools and actually scales with how enterprises ship software. Our joint customers integrate it with Endor Labs for malicious package firewalling, function-level reachability, and automated remediation. That combination is powerful for securing the AI coding era.”

 – Varun Badhwar, Founder and CEO, Endor Labs

“Cloudsmith has been a great partner with Aikido. We're both re-inventing what it means to secure the software supply chain. We're seeing Cloudsmith a lot more in our customer base, and they're great to work with.”

 — Roeland Delrue, Co-founder and COO, Aikido

Software supply chain attacks, regulatory pressure, and enterprise platform consolidation make artifact management a board-level concern.

Enterprises see artifact management platforms as the crucial enabler of engineering speed, security control, compliance evidence, and software trust.

Our lead investors, TCV and Insight Partners, understand that shift. They invested in our Series B last year, and we’re grateful for their growing belief and conviction:

“Having led Cloudsmith’s Series B and now its Series C, TCV is proud to deepen our partnership with a company we see as defining artifact management for the AI era. As AI shapes the software supply chain, we believe Cloudsmith is uniquely positioned to become a platform enterprises rely on for compliance, control, and security at global scale.”

“In an era increasingly defined by AI-driven development, securing the software supply chain is critical. As a cloud-native offering, Cloudsmith is well-positioned to do this – providing the scale and reliability needed to power enterprise and AI-driven builds and mitigate emerging risks. We believe in Cloudsmith’s vision to secure the software supply chain by serving as a curated, AI-ready solution for enterprises of all sizes.”

 — Thomas Krane, Managing Director, Insight Partners

. We’re serving a rapidly growing range of technology and software companies, AI startups, mid-market companies, and mainstream enterprises. They all want a software supply chain that’s fast enough for developers, safe enough for security teams, clear enough for audit and compliance, scalable enough to keep up with their ambitions, and simple enough that it just works.

Cloudsmith just works - whether it’s failover, automation, or support. It’s the first platform we’ve used that feels like a true partner in how we build and operate software.

We’d like to think that the best infrastructure companies are ahead of their time, and that the foundations Cloudsmith laid down years ago are paying off today.

In the compiler era, we converted human intent into reliable software. In the cloud era, we operated software at a global scale for the first time. In the AI era, we need to figure out how to use and trust software that’s created, assembled, and changed faster than humans can manually inspect or even fully understand.

Cloudsmith is here to help answer that question.

When we started, artifact management was not a sexy part of developer infrastructure. It was seen as low value. Open source was ‘free’. But we could see the risks emerging as more and more software teams increasingly relied on packages, registries, and automation. That dependency is now massive, and so is our responsibility.

A heartfelt thank you to our customers. You’ve trusted Cloudsmith, sometimes before it was obvious why our software category was so important. You’ve consistently pushed us to build better because you rely on us for critical infrastructure, engineering, security, and platform workflows. We take that responsibility seriously.

Every Cloudsmither can take pride in our passion for our craft and in the hard work that has made Cloudsmith the company it is today - a special place. The market is pulling toward the problems we set out to solve from the beginning. This is our moment, and it’s time to earn it.

We’re by developers, for developers, and we always have been. We feel a kinship with the builders, platform teams, security professionals, and enterprise leaders who want to build safely in the age of AI. Because software is becoming easier to create than to trust.

We’ve got Cloudsmith 2.0 and the future of the software supply chain to build.

Glenn Weinstein

Check out press coverage, a video from our leadership team, and a note from our investors

Learn about our Series C

We built Cloudsmith for this moment

Our mission at Cloudsmith is to provide development, DevOps, and platform engineering teams with an incredibly powerful, easy-to-use tool for controlling and securing software artifacts globally. We build features with the enterprise in mind–features that provide centralized management and policy enforcement across hundreds of teams and thousands of developers.

We have an ambitious vision to run the world’s software supply chain more efficiently, more securely, and more intelligently than is possible with the traditional set of tools available in our market.

To that end, we made fantastic progress in 2025 in extending the reach of Cloudsmith to organizations new to enterprise-grade artifact management platforms, as well as organizations upgrading from legacy vendors to meet their internal scalability and security requirements. Let’s review some key milestones we achieved in 2025 with our customers and partners.

A peek behind the curtain into the goings-on at Cloudsmith HQ.

 and many of our existing investors. This investment reflects the confidence our customers place in Cloudsmith to control their mission-critical software build workloads, as well as the hard work from every Cloudsmither. We’re using the funding to build an even better Cloudsmith that can cover more use cases, handle near-infinite scale, and be the fastest and most reliable solution on the market.

We added quite a few Cloudsmithers, increasing our total headcount by 92% in 2025. We’re using all that effort and brainpower to stay on top of the software supply chain security space, so we can help our customers protect their own build pipelines against emerging threats.

A couple of notable honors made their way to Cloudsmith HQ this year:

: Tech Visionary of the Year – Cloudsmith CTO Lee Skillen.

 Leaderboard 2025: Cloudsmith ranked number 59.

Ships are nothing new in Belfast, our home city which has a proud shipbuilding history. That said, at Cloudsmith, we prefer to ship code. Here are a few highlights from the new features and capabilities we launched in 2025:

: Cloudsmith extends artifact management and governance to 

 and datasets, allowing you to control and manage AI artifacts alongside the rest of your software supply chain. ML models flow through the same access controls, policies, scanning, and audit trails as packages and containers, so adopting AI doesn’t introduce new blind spots or require parallel tooling.

 Enables you to define policies as code that match how your pipelines and security rules actually work. Policies can incorporate context such as package metadata, vulnerability severity, and licenses, and enforce those criteria before promoting or using artifacts.

: Automatically checks artifacts for vulnerabilities, malware, and malicious packages on a rolling basis, generating reports hourly. When a new vulnerability is reported against a previously allowed package, EPM triggers a re-evaluation of artifacts against your standing policies and automatically takes actions, such as blocking or quarantining.

Malware scanning and malicious package detection:

 Adds malware and malicious package detection to traditional vulnerability scanning, preventing malicious packages from entering repositories or being distributed. This helps teams avoid pulling in unsafe dependencies from upstream sources and reduces the risk of compromised software spreading through CI/CD pipelines or to customers.

: Enable teams to distribute software to customers or partners in a developer-native way, using the same delivery platform and governance they rely on internally, while presenting it through a branded, customer-facing experience. Customers can restrict, audit, and revoke access without setting up parallel systems or losing visibility–so external delivery doesn’t become a security or operational exception.

: We added new upstreams for four supported formats this year (

), and increased our support for native signing to include 

: When you want to give your eyes a rest, dark mode is at the ready!

We know our customers derive business value from Cloudsmith, because they’re building more software with Cloudsmith.

Total package delivery increased 352% YoY.

The most popular artifact types were Python, npm, NuGet, rpm, Debian, and Maven, which together made up 90% of all artifact requests.

The most consumed formats by size (accounting for 90% of total gigabytes delivered) were Docker, Python, raw, npm, and NuGet.

💡Interesting fact: In total bytes, Docker image deliveries in the first 

 of December 2025 was nearly the same as that for the entire month of January 2025.

npm and Python package delivery requests increased by 400% YoY.

Plays Well With Others: Community, Events, and Integrations

The Cloudsmith platform does a lot of heavy lifting, and it does even more together with our partners. We trotted (a good portion of) the globe and scoured the corners of the internet to deliver a better artifact management experience to developers and organizations alike.

We were active in the developer community in 2025. We sponsored or attended 18 events across North America and Europe, connecting with developers and platform teams in 10 cities at KubeCon + CloudNativeCon, GitHub Universe, PlatformCon, SRECon, and Container Days.

We’re in it for the bright lights and big stages, but some of our favorite moments came from smaller, high-impact community meetups like Kubernetes Community Days in New York and Edinburgh, Cloud Native Dublin, and BSides in our hometown of Belfast.

At every stop, big or small, our goals were to learn from the community, share what we’re building, and help teams ship software with confidence.

It’s worth noting that Cloudsmithers from all over the world also gathered three times this year in our home city of Belfast for all-hands offsites to learn, share, and grow together.

We’re developers building for developers. For us, it’s important to improve the developer experience. We built integrations for developer tools this year to make it easier for users to manage and secure their development pipelines. Here are a few highlights from 2025.

: Allows users to manage experiments run on ML models and collaborate in a centralized location for machine learning test cases.

 integration for better observability and monitoring of how artifacts flow through your software supply chain.

, both public and private Chainguard registries, natively with Cloudsmith.

: Explore and inspect your artifacts from within your 

: Bringing secure artifact management to machine learning development.

From initial conversations, to migrations, to ongoing support, Cloudsmithers provide users with the service and attention they need to make artifact management “just work.” Our customer support satisfaction rose to 

Here’s some of our favorite feedback from customers:

"It's rare these days to see this level of support and engagement when dealing with SaaS support."

"I must say that the support we have received from Cloudsmith has been outstanding."

"I feel it’s important to recognise the Cloudsmith team who have been wonderful throughout the whole process...[they] were patient, fun to talk with (just real-human), knowledgeable, flexible, and truly listened to our needs."

We also published new case studies that demonstrate Cloudsmith’s value, showing how the Cloudsmith experience unfolds from the customer’s point of view.

 shifted focus from infrastructure to managing artifacts securely with Cloudsmith.

 migrated to Cloudsmith and eliminated outages entirely.

consumer and industrial electronics organization

 leveraged Cloudsmith’s Enterprise Policy Manager for better package visibility and governance.

We’re proud of what we helped customers achieve in 2025. And we’re doubling down on our R&D investments in 2026 to deliver an artifact management platform that exceeds anything on the market today.

We want Cloudsmith to be a platform that:

Takes full advantage of our massive-scale, multi-tenant architecture to deliver previously unthinkable performance and scalability to CI/CD pipelines and IDEs no matter where they’re located.

Provides practical solutions for securing the enterprise software supply chain from open source vulnerabilities and malicious packages without hindering productivity.

Works in conjunction with your DevOps stack to deliver a single source of truth for software artifacts, informed by huge public data sets and AI-powered insights.

And we’ll do it all with our ultimate customer–the software developer–foremost in our minds.

Please reach out to me at ceo@cloudsmith.com with your thoughts and suggestions as we seek to build the artifact management platform that the world truly needs. 

Cloudsmith 2025: By the Numbers

That’s what I want for Northern Ireland’s software sector. And we are doing it together.

Northern Ireland is a great place to live. Culturally, we are a country of innovators and builders, and it is already a great place to build software. Whether you are starting something new or want to contribute to systems and tools used all over the world, the software industry in NI is well-established.

Yes, we have our challenges as a country, just like anywhere else. But we have an exciting and emerging startup ecosystem, circling venture capital, and we are the software development headquarters for big companies like Aflac, Allstate, and Liberty Mutual. And we finally have an official LEGO store.

I left Northern Ireland two days after graduating from Queen’s University Belfast in 2002, and lived in the United States and then England for a few years. But soon the love of grey skies pulled me back home and into a job at a newly minted startup, albeit one that struggled to find its feet. 

After moving on from my first NI-based startup. I then watched Danny Moore sell Wombat Financial Technologies to the mighty New York Stock Exchange in 2008. This was a signpost of what is possible with great leadership and execution. So when Lee and I founded Cloudsmith, our goal was, and still is, to build a world-class product company headquartered in Belfast.

There are many challenges with building a business, especially in a small country with just under 2 million people. We have great universities in Ulster University and Queen’s (and not forgetting our friends at the Open University), producing a steady stream of graduates; there is a growing talent pool and lots of opportunity for innovation.

Those who have tasted success can inspire, guide, and expand the limits of what is possible.

It's pretty unusual to be more than two degrees of (Kevin Bacon) separation away from anyone from Northern Ireland here. We witnessed firsthand the power of diaspora: Northern Ireland looks out for its own, and we made connections all over the world with folks who left to seek their fortune in faraway lands. Some have been absolutely key to Cloudsmith’s success to date, and it’s always a pleasure to hear the unmistakable accent come back at you over Zoom.

We need more success stories. We need to show the workforce that share options are worth something. We need more exits. We need to create more wealth.

I’ve seen the power of being in a well-funded startup with great, founder-friendly early-stage backers (thank you, Techstart, Frontline, and MMC) that can elevate you to take on the competition.

How do we get more money into Northern Ireland companies? How do we get the light from Sauron’s Eye shining on our little country? OK, that sounds ominous, but I mean it in a good way. How can we position ourselves as a hotbed of innovation and talent, to rival Silicon Valley or Tel Aviv?

That is something we are tackling at Software NI, but we need all the help we can get. 

 is dedicated to making Northern Ireland a global leader in technology and software innovation through community, education, advocacy, and support. Everything from championing software literacy in schools to affecting governmental policies to ensure software is part of our future.

We welcome you to engage with the community at the new 

, organized by Software NI. The inaugural event will take place on Thursday, 26th March, in The Mac. It promises to be an excellent opportunity to listen to industry leaders, including Danny Moore, discuss how they scaled their businesses and created value. I’ll be there too :)

Remember, Northern Ireland is amazing, Cloudsmith is building something great, and Software NI is striving to create an ecosystem where people and software companies of all shapes and sizes can thrive.

Alan Carson

Co-founder and Chief Strategy Officer

I love Software (in) NI

Across your organization, teams are rapidly adopting AI and machine learning. They’re pulling ML models and datasets from public sources like Hugging Face and wiring them into workflows that are now reaching production. For platform and security leaders, this creates a familiar challenge: artifacts are entering the software supply chain outside established governance and controls.

Unmanaged AI artifacts carry real risks. They can’t be traced back to their source, they don’t follow compliance processes, and they often bypass the review gates you rely on for code and containers. Left unchecked, they become blind spots and liabilities in your supply chain. Without action, AI artifacts become the weakest link in your supply chain security.

The answer is to manage ML models and datasets with the same level of control and oversight as every other artifact in your supply chain. By managing them through a unified platform—with shared repositories, consistent policy enforcement, and full observability—you ensure that ML workflows are governed by the same standards as the rest of your software supply chain.

The growing adoption of ML models and datasets introduces both opportunity and risk. On one hand, models accelerate delivery by enabling new capabilities at unprecedented speed. On the other hand, they introduce opaque dependencies, security blind spots, and compliance risks into the supply chain—areas where governance practices are still catching up.

Some risks begin earlier in the lifecycle, like poisoned training data or tampered weights during model creation, which can compromise a model before it ever reaches a registry. But the most immediate challenge for platform and security leaders is governance once these artifacts enter the supply chain. Teams often pull models directly from public sources like Hugging Face, bypassing review and scanning. Without versioning and provenance tracking, it’s nearly impossible to prove which model is in use, where it came from, or what depends on it. And without consistent policies, organizations struggle to demonstrate compliance when auditors or regulators come calling.

These risks can’t be left unmanaged. The question is how to bring ML artifacts under control.

ML models and datasets are artifacts, and like any artifact, they need to be versioned, audited, and controlled with the same enterprise-grade policies you’ve put in place for packages like code libraries and container images. As organizations deliver production applications powered by AI, the priority for platform and security leaders is clear: maintain visibility, integrity, and trust in the components that make up these builds.

Cloudsmith’s new ML Model registry support

A Single Source of Truth for ML Models in DevOps

Cloudsmith extends artifact management to ML models and datasets, promoting them to first-class artifacts in your supply chain. This means you can control, secure, and distribute models alongside your language libraries, containers, and other binaries, all governed by the same policies and observability already in place.

: Require approvals, license checks, and compliance gates before a model or dataset is deployed.

Cloudsmith Blog

Trust your software supply chain from ingestion to production

We built Cloudsmith for this moment

Cloudsmith 2025: By the Numbers

I love Software (in) NI

Extending supply chain governance to AI and ML artifacts

The Artifact Management Market Is Up For Grabs

Prototyping an MCP Server

What Cloudsmith’s Series B Means for Our Customers

Cloudsmith 2024: By the Numbers

A Year to Remember: Cloudsmith’s Journey Through 2024 🚀🌍

Launching the new Cloudsmith Web App

Cloudsmith Shines Bright at Digital DNA Awards