By submitting this form, you agree to our 

Cloudsmith’s Enterprise Policy Management (

) now supports the Exploit Prediction Scoring System (

), a data-driven metric designed to estimate the probability of a software vulnerability being exploited in the wild. Using EPM in Cloudsmith, you can now use a package’s EPSS score to inform your package workflows, including those around 

EPSS scores or estimates the likelihood (probability) that a software vulnerability will be exploited in the wild. Cloudsmith users can use EPSS scores to prioritize vulnerabilities most likely to be exploited, to strengthen your organization’s security posture and automate your response to vulnerabilities.

) and leverage EPSS-based logic in their OPA policies for more granular, data-informed decisions around vulnerability management. This automated responses approach allows Cloudsmith users to remain protected in real time as Cloudsmith automatically re-checks and re-applies your policies when EPSS scores change.

 will quarantine and tag a software package with “

” vendor severity rating and if the EPSS score exceeds the defined threshold in your 

For the purpose of a real-world demonstration, we will use the vulnerable Spotipy package as highlighted in 

 example is a Python library specifically used with the Spotify Web API. Affected versions of this package are vulnerable to 

 through the CacheHandler class. In this scenario an attacker could gain unauthorized access to admin-level actions on the Spotify account by reading Spotify authentication tokens exposed in the file created by the CacheHandler class with the 

What’s interesting about this example is that it was picked up by EPSS but hasn’t yet received a “vendor severity” scoring from 

, emphasizing the need for EPSS as well as traditional vendor scoring sources within our EPM policies. Vulnerability naming schemes, like the Common Vulnerabilities and Exposures (

) system, provide standardised identifiers for publicly known IT system vulnerabilities. This CVE classification differs from EPSS in the sense that EPSS uses real-world threat data to predict the likelihood of those vulnerabilities being exploited

In the above example, you can see that spotify was detected with a vulnerability from the recently applied policy. The tag was added with “exceeded-epss” providing that it was the EPSS predictability score that caused the quarantine status. Package quarantining allows users to temporarily block any downloads of a package until you release the package from that quarantine state.

If you like to see a demo of the Cloudsmith’s EPM capabilities with EPSS confidence scoring, why not call over to 

, South Hall – ExCeL London. We’ll be providing live demos until Friday.

Nigel Douglas

Head of Developer Relations

Cloudsmith introduces EPSS Scoring in Enterprise Policy Management (EPM)

Signing Artifacts to Prevent Artifact Poisoning

Breaches in software artifact integrity can have severe consequences. Bad actors poison artifacts by injecting malicious code into software packages, libraries, or container images, tricking developers and users into downloading compromised artifacts. These attacks can lead to data breaches, system takeovers, and widespread supply chain disruptions.

Continued artifact poisoning incidents highlight the increasing risk to software supply chains. A recent 

 let attackers inject malicious code into artifacts, compromising CI/CD pipelines. 

 enabled remote code execution and tampered dependencies. These cases underscore the need for strong artifact verification.

A highly effective defense against artifact poisoning is cryptographic signing, which verifies the authenticity and integrity of software artifacts. By digitally signing artifacts, developers use a private key to generate a cryptographic signature unique to their software. When an artifact is retrieved, the corresponding public key is used to verify the signature, checking that you can trust the source and the artifact hasn’t been tampered with.

Signing can be a complex process due to the expertise required and the various components involved. Developers need knowledge of key management, certificate verification, signing standards, and security policies. A good artifact management system aims to simplify this process.

When signing artifacts, there are two fundamental approaches:

 – Uses the artifact's built-in signing support (e.g., Swift Package Manager’s built-in signing, npm’s signature verification). This integrates well with artifact workflows, ensuring signatures are tied directly to the artifact format and verified automatically by native package managers.

, independent of the package format. While flexible and commonly used, third-party signing requires additional manual steps for verification.

Native signing is automated, built-in, and verifies artifacts within their ecosystem. Third-party signing tools such as GPG offer greater flexibility and compatibility, but they require manual integration and verification.

Native signing plays a role in maintaining compliance with industry and government regulations by ensuring that software artifacts are verifiable, traceable, and tamper-proof. It enforces cryptographic integrity, meeting the requirements of standards like SLSA, S2C2F, and FedRAMP Rev 5.

 enforces stricter security controls for software integrity and supply chain protection. Native signing supports this by ensuring artifacts remain verifiable, untampered, and compliant with cryptographic policies. Integrating native signing into CI/CD pipelines automates verification, simplifies compliance reporting, and aligns with FedRAMP’s Zero Trust principles.

Extending Native Support to Swift, NuGet, and Docker

Cloudsmith supports non-native signing for all package formats. In practice, organizations are making use of native signing for certain formats to improve workflows and reach compliance.

As part of Cloudsmith’s prioritization of security and compliance, three more package formats have been added to the roster for native signing support. Swift, NuGet, and Docker’s native signing tools can now be used in Cloudsmith, streamlining the workflow and eliminating the need for manual verification using GPG. These formats add to existing native signing support for Maven, Gradle, npm, RPM, SBT, Debian, and Alpine.

Cloudsmith is the first artifact management platform to offer Swift native signing. This positions Cloudsmith as a leading contender for enterprises engaged in Apple’s development ecosystem.

When working with Docker images, Cloudsmith uses Sigstore’s Cosign to automatically add a signature on upload. This uses an ECDSA (Elliptic Curve Digital Signature Algorithm) private key which is a type of public-key cryptography. An ECDSA key is generated automatically when you create a repository.

Cloudsmith automatically signs an image when it is uploaded using the repository’s ECDSA private key.

Anyone using the image can verify that it is trusted by downloading the matching ECDSA public key.

Alternatively, you can upload your own Cosign signature using 

Cloudsmith now supports native signing for all NuGet packages 

, a digital certificate that uses public key infrastructure (PKI) to verify the authenticity and integrity of signed artifacts. This allows consumers to verify repository signatures directly within native tooling or the NuGet CLI.

Native signing is enabled for the Cloudsmith repository, which issues a unique X.509 certificate.

When a NuGet package is uploaded or resynced, a repository signature is generated, and the signing certificate is included in the NuGet repository 

If a NuGet package contains an author signature, Cloudsmith will countersign the package.

Users can verify a package’s repository signature locally using native tooling or the NuGet CLI, confirming that the package originated from Cloudsmith.

Swift packages are signed using ECDSA private key in combination with an X.509 certificate, which holds the corresponding public key.

 consist of a source archive and a manifest file. The source archive contains the package’s sourced code and the manifest defines package details, dependencies, and configuration.

The manifest signature is an ‘attached’ signature - it is stored directly in the manifest file.

The source archive signature is a ‘detached’ signature - it is included in the metadata response when fetching a package by scope, name, or version. Swift verifies package signatures by checking the signing attribute in the metadata response. The source archive signature is generated after signing the manifest.

Swift signing in Cloudsmith works as follows:

Swift packages are signed with the X.509 certificate when a package is uploaded or synchronized.

Existing packages need to be resynchronized to append the signature to the manifest and generate one for the source archive.

To ensure secure artifact validation, Swift CLI uses a registry security configuration, defined in a JSON file for each user.

Take a look at the following documentation pages for more detailed information on how to use signing in Cloudsmith:

Ian Taylor

Tech Content Director

Native Signing Support In Cloudsmith Extended To Docker, NuGet, And Swift

cloudsmith_series_b_V6

Today we announced Cloudsmith is officially a Series B company. This $23M fundraising round was led by 

, as well as most of our existing investors. What a vote of confidence in our team, our vision, and our market!

 in 2023 for two reasons: (1) artifact management and software supply chain security are mission-critical to enterprises, and (2) there’s an opportunity for serious disruption of JFrog and Sonatype, the two legacy players.

We now have a pile of evidence that proves this thesis. Over the past year, we’ve closed over 100% of our total pipeline at the start of each quarter. The demand is there. The average deal size is up 5x. We now boast an impressive roster of Fortune 500 and Global 2000 companies that have made the switch - on behalf of their hundreds of software teams and thousands of developers - to Cloudsmith’s cloud-native, massive-scale platform.

That kind of growth attracts investor attention. Software is the lifeblood of every company in every industry. Writing better, more secure software, and deploying it to production faster, is a massive competitive advantage. Having a bulletproof artifact management platform to power your software supply chain delivers that advantage. I’m grateful to our partners at TCV and Insight for believing in Cloudsmith as the company to provide that platform, and welcome 

Fundraising is an exciting, emotional roller coaster. It’s easy to get distracted. But we have serious work to do. It’s on us - the team here at Cloudsmith - to live up to our promises to our customers and the market. To deliver even deeper support for all popular formats across languages, operating system libraries, and containers. To provide a bridge between the CISO’s vision for security, and the VP Engineering’s need for developer efficiency. To scale up the Cloudsmith platform so we continue to be the fastest and most reliable solution on the market. To address a wider variety of deployment use cases. To make it easier to verify the provenance of artifacts that make it into your software supply chain.

 that we’d expand our customer success organization to deliver world-class onboarding services; we’d invest in engineering and innovation; and we’d expand our global footprint. We’ve done all of that and more. We’ll keep investing in our customers’ success. We want software developers to have a delightful experience selecting open-source packages. We want platform engineering teams to rely on Cloudsmith as a trusted partner in building software. We want cybersecurity professionals to lean on Cloudsmith as their key tool for implementing software usage policies.

Thank you to our investors, Cloudsmithers, and, most importantly, our customers for powering the Cloudsmith journey. Onward!

Glenn Weinstein

What Cloudsmith’s Series B Means for Our Customers

Enterprises should prioritize securing their software artifacts to protect intellectual property (IP), maintain compliance, and mitigate supply chain risks. A strong security posture requires a deep understanding of access management, distribution controls, compliance enforcement, and software lifecycle governance.

This guide explores key principles of software security and best practices that enterprises can adopt to ensure software remains protected from unauthorized access, compliance violations, and supply chain threats.

Implementing Enterprise-Level Access Control

Effective access management is the foundation of software security. Enterprises should:

Adopt Role-Based Access Control (RBAC) to define and enforce access policies at a granular level.

Leverage Single Sign-On (SSO) via SAML to streamline authentication and centralize user identity management.

Use SCIM integration to automate user provisioning and deprovisioning, ensuring timely access adjustments.

Establish structured team and service account management to prevent unnecessary access and privilege escalation.

By implementing these controls, organizations ensure that only authorized personnel interact with software artifacts, reducing security risks and enforcing least privilege access.

Controlling Software Distribution with Entitlement Management

For enterprises distributing software externally, precise access control is essential. Best practices include:

Using entitlement tokens to grant controlled, read-only access at an individual package level.

Monitoring and tracking software downloads to maintain visibility over usage.

Revoking or modifying access as needed to comply with licensing terms and security policies.

These techniques help organizations manage software distribution securely while maintaining complete visibility into how assets are accessed and used.

Meeting Compliance and Location-Based Security Requirements

Global enterprises must align software storage and access with compliance requirements. To do so, they should:

Enforce Geo/IP restrictions to control where software can be accessed.

Utilize custom storage regions to align with regional data sovereignty and regulatory requirements.

These measures ensure enterprises maintain compliance with industry regulations while safeguarding sensitive data.

Auditing, Tracking, and Managing the Software Lifecycle

Visibility and traceability are critical to software security. Enterprises can enhance security by:

Maintaining client logs to track software access and detect unusual activity.

Implementing audit logs to track administrative and operational changes.

Defining retention and lifecycle rules to automatically archive or remove outdated software artifacts.

With continuous monitoring, organizations can quickly detect and respond to potential security threats while streamlining compliance reporting.

Ensuring Secure Software Promotion and Delivery

To maintain a secure software pipeline, organizations should:

Implement package promotion workflows to control how software transitions from development to staging and production.

Establish provenance tracking to maintain an immutable record of software lineage.

Enforce security policies that verify software integrity before deployment.

By embedding these security measures into the software development lifecycle, enterprises can reduce risks and ensure that only trusted, verified software is deployed to production environments.

Adopting a Zero Trust Approach to Software Security

A Zero Trust security model - where no entity is trusted by default - helps organizations maintain security across their software supply chain. By focusing on robust access controls, entitlement-based distribution, compliance enforcement, and continuous monitoring, enterprises can strengthen their security posture while maintaining the agility to innovate and scale.

By mastering these security principles and leveraging the right tools, organizations can take full control of their software IP, ensuring that their most valuable digital assets remain secure, compliant, and resilient against evolving threats.

For enterprises seeking a comprehensive solution to manage and secure their software artifacts, Cloudsmith offers a universal, cloud-native platform designed to meet these needs. With features such as role-based access control, entitlement management, compliance enforcement, and advanced observability, Cloudsmith empowers organizations to implement robust security measures across their software supply chain. To learn more about how Cloudsmith can enhance your software security strategy, 

Maia Livingstone

Campaign Manager

Enterprise-Grade Software Security: Mastering Control Over Your Software IP

Continuous Integration and Continuous Deployment (CI/CD) pipelines power modern DevOps. They enable teams to deliver software faster, with greater reliability and confidence. However, as development accelerates, ensuring security, compliance, and quality becomes increasingly complex. Automated policy checks streamline CI/CD pipelines by addressing these challenges directly.

Enhanced SecurityManual reviews are error-prone and inconsistent. Automated policy checks enforce security protocols reliably, vetting builds, dependencies, and code changes against predefined standards. Cloudsmith provides a centralized platform to manage these policies, ensuring that every artifact and package meets compliance requirements before entering your pipeline.

 Secure and Compliant Software Delivery with Cloudsmith Policy Management

 explains how policy management features enable security and compliance enforcement.

Regulatory ComplianceStrict compliance requirements in industries like finance, healthcare, and government demand precision. Automated checks ensure releases meet regulatory standards, minimizing the risk of fines or breaches. These compliance expectations are rapidly becoming industry-wide best practices, meaning all organizations - not just regulated industries - should adopt robust security and compliance policies. 

Using Cloudsmith as a Dependency Firewall

 highlights the importance of controlling package consumption to ensure compliance.

Increased EfficiencyManual interventions slow pipelines and create bottlenecks. While some teams may still manually review or approve changes, this approach is unsustainable at scale. Automated checks provide real-time feedback, accelerating delivery cycles while maintaining governance. The 

6 Essential Features for Your Next Artifact Manager

 blog outlines crucial capabilities that improve efficiency.

Reduced RiskBy identifying vulnerabilities, misconfigurations, and compliance issues early, automated policy checks lower the chance of deploying faulty code. Policies managed at the artifact level - such as those provided by Cloudsmith - ensure that only secure, compliant assets enter production.

Dependencies often introduce vulnerabilities. Automated tools analyze dependencies for security risks, license compliance, and outdated versions, blocking risky packages from production. Cloudsmith natively integrates these checks within its artifact management platform, offering an additional layer of security beyond CI/CD pipeline-level scans.

Automated gates ensure new code meets quality standards, such as code coverage and complexity thresholds. While tools like SonarQube enforce these rules at the CI/CD level, policy management at the artifact level ensures only vetted packages are distributed downstream.

IaC tools, such as Terraform and CloudFormation, benefit from automated validation. These checks catch misconfigurations and enforce deployment best practices before infrastructure changes are applied. The 

Enforce Secure Automated Deployment Practices through IaC

 webinar explores how policy enforcement in IaC can improve security.

Teams using containers can automate image scans to flag vulnerabilities or misconfigurations before deployment. Cloudsmith helps enforce security and compliance policies at the artifact level, ensuring only approved container images are used in production.

Automated policies control deployment conditions, such as requiring approvals for production releases or enforcing restrictions on specific environments. Centralized artifact management allows organizations to implement stricter governance beyond what is possible within a CI/CD pipeline alone.

Implementing Automated Policy Checks in CI/CD Pipelines

Select tools that integrate seamlessly with your existing CI/CD pipeline. A combination of CI/CD-based policy enforcement and artifact-level policy management, like Cloudsmith, provides a more comprehensive approach.

Collaborate with security, compliance, and engineering teams to create policies aligned with organizational goals. Policies, defined as code, are the future and offer greater power and flexibility compared to rigid, rule-based checks. Using Open Policy Agent (OPA) allows teams to express policies in a declarative, code-based format for better automation and enforcement.

Shift left by implementing policy checks early in the pipeline. This prevents issues from propagating downstream and ensures that security and compliance are addressed from the start.

Use logs, reports, and feedback to refine policies and improve tools regularly. Cloudsmith provides real-time insights into artifact security, compliance, and policy enforcement, helping teams proactively manage risk. 

Consuming Open Source Securely Using S2C2F

 provides guidance on incorporating open-source components securely into CI/CD pipelines.

Automated policy checks are essential for scaling CI/CD pipelines without sacrificing security, compliance, or quality. While CI/CD tools can enforce some policies, centralizing policy enforcement at the artifact management layer with Cloudsmith provides a more holistic and effective approach.

Streamline your CI/CD pipeline today. Learn how Cloudsmith can help automate your policy checks and optimize your DevOps processes. 

Streamlining CI/CD Pipelines with Automated Policy Checks

Managing software artifacts across distributed teams and complex infrastructures securely demands proactive measures. Robust policy management is the best way to ensure compliance in your software supply chain. Cloudsmith, the leading cloud-native package management platform, can streamline policy management and strengthen security. Let’s explore why policy management matters and how we can simplify it for you.

Policy Management is a structured way to define, implement, and enforce rules and guidelines in your software delivery process. Effective policy management:

Enhances Security: Enforces strict access controls and ensures the integrity of your software artifacts, reducing vulnerabilities and minimizing risks.

Ensures Compliance: Helps you adhere to GDPR, HIPAA, SOC 2, and other regulatory frameworks, keeping you audit-ready.

Maintains Consistency: Standardizes workflows across teams, ensuring that everyone operates within established guardrails.

Boosts Efficiency: Automates policy enforcement, reducing manual overhead for approvals and compliance checks.

For a deeper dive into Cloudsmith's approach to enhancing security and compliance through policy management, check out 

Cloudsmith's Enhanced Security with Policy Management

Cloudsmith Policy Management: A Holistic Approach

With Cloudsmith, you take full control of your package repositories with policy management. These make Cloudsmith the ideal choice for teams prioritizing security and compliance:

You set granular permissions for users, teams, and API tokens. Using role-based access control (RBAC), you can:

Assign repository access based on user roles.

Apply least-privilege principles to ensure users access only what they need.

Monitor and audit access logs to detect anomalies.

Learn more about how Cloudsmith supports Zero Trust security principles in 

Implementing Zero Trust Security with Cloudsmith in 5 Steps

Efficient storage management reduces costs and enhances security. Cloudsmith lets you:

 to automatically remove outdated or unused artifacts after a specified time.

Use Disposal Policies to securely delete artifacts while maintaining an audit trail, ensuring data governance compliance.

Controlling where your data can be stored or accessed is a crucial part of many compliance frameworks. Cloudsmith supports geo-restriction policies, allowing you to:

Restrict repository access based on geographic regions.

Check out how Cloudsmith has helped organizations like SaaS providers comply with GDPR and data residency requirements in our 

 Security Scanning and Vulnerability Policies

To protect your software supply chain, Cloudsmith integrates security scanning directly into the platform. You can:

Block packages with known vulnerabilities.

Automatically notify teams when critical issues are detected.

Licensing compliance is an important part of managing open-source dependencies. With Cloudsmith, you can:

Define acceptable licenses for your projects.

Block artifacts that violate license compliance policies.

Generate reports for audits, ensuring transparency.

Cloudsmith empowers you to automate policy enforcement by integrating with CI/CD pipelines. By embedding policy checks into your workflows, you can:

Automatically validate artifacts against predefined rules.

Prevent deployment of non-compliant artifacts.

Accelerate delivery cycles while ensuring compliance.

To learn how policy enforcement can be integrated into your DevOps workflows, explore 

Kong – Streamlining Artifact Management and Distribution

Kong, a prominent open-source API management platform, required a robust solution to manage and distribute their software artifacts efficiently. By partnering with Cloudsmith, Kong was able to:

Centralize Artifact Storage: Utilize Cloudsmith's universal artifact management to store all their packages in a single, secure location.

Implement Fine-Grained Access Controls: Define and enforce policies that ensure only authorized personnel have access to specific repositories and artifacts.

Enhance Distribution Efficiency: Leverage Cloudsmith's global edge caching to deliver artifacts swiftly to their global user base.

This collaboration resulted in a more streamlined and secure artifact management process, allowing Kong to focus on developing their core products without worrying about the complexities of artifact distribution.

Best Practices for Policy Management in Cloudsmith

Policy management is even more powerful with some planning, collaboration, and continuous improvement. Here are some best practices to help you maximize the value of Cloudsmith policy management:

Your security, compliance, and development teams can establish policies that align with your organization’s goals. Consider these steps:

Identify Key Objectives: Are you looking to adhere to regulatory requirements like SOC 2? Or reduce security vulnerabilities in production?

Collaborate Across Teams: Involve stakeholders from DevOps, security, and legal teams to ensure policies cover access control, licensing, and vulnerability scanning.

Create a Policy Library: Maintain a centralized repository of all approved policies so it’s easy for teams to reference and follow them.

Pro Tip: Use policy templates and the Enterprise Policy Manager to standardize and scale policy creation across multiple teams. Learn more about Cloudsmith's 

Continuous monitoring helps you stay ahead of potential risks and ensure compliance over time. Cloudsmith offers built-in monitoring tools to help you track and report policy adherence. To maximize their effectiveness:

Audit Regularly: Leverage Cloudsmith’s Audit Logs to monitor actions performed by users, systems, and service accounts. This feature provides a complete history, enabling you to identify anomalies and ensure compliance.

Track Key Metrics: Monitor metrics like artifact vulnerability rates, license violations, and geographic access patterns to stay proactive in your security efforts.

Set Alerts: Configure notifications for critical issues, such as non-compliant artifacts or unauthorized access attempts, so your team can respond quickly.

For more details, check out Cloudsmith’s guide to 

By embedding policy checks into your DevOps workflows, you can maintain compliance without slowing down delivery. Here’s how:

Automate Artifact Validation: Use Cloudsmith’s APIs to automatically validate artifacts against predefined policies during your CI/CD pipeline runs.

Prevent Non-Compliant Deployments: Configure your CI/CD tools to block deployments that fail security or compliance checks, ensuring that only approved artifacts make it to production.

Leverage Pipeline Integration: Integrate Cloudsmith with popular CI/CD tools like CircleCI, GitHub Actions, and GitLab to streamline policy enforcement.

For more information on managing package promotion workflows, check out 

How to Manage Your Package Promotion Workflows with Cloudsmith

By automating policy enforcement, your team can accelerate delivery cycles while maintaining security and compliance.

Your policies need to keep pace with change. Regularly reviewing and updating your policies ensures they remain relevant and effective. Follow these best practices:

Schedule Regular Audits: Conduct quarterly policy audits to ensure they align with current regulations and organizational goals.

Adapt to New Threats: Stay informed about emerging vulnerabilities and security risks, updating your policies to address them.

Solicit Feedback: Encourage teams to share their experiences with existing policies and suggest improvements. This collaborative approach fosters a culture of compliance and innovation.

Cloudsmith Blog

Cloudsmith introduces EPSS Scoring in Enterprise Policy Management (EPM)

Native Signing Support In Cloudsmith Extended To Docker, NuGet, And Swift

What Cloudsmith’s Series B Means for Our Customers

Enterprise-Grade Software Security: Mastering Control Over Your Software IP

Streamlining CI/CD Pipelines with Automated Policy Checks

Secure and Compliant Software Delivery with Cloudsmith Policy Management

Cloudsmith 2024: By the Numbers

A Year to Remember: Cloudsmith’s Journey Through 2024 🚀🌍

Thoughts on Datadog’s new Supply-Chain Firewall

Mastering Your JFrog Artifactory Migration: Steps to Success

Launching the new Cloudsmith Web App

Elevating Software Distribution with Cloudsmith’s Broadcasts