By submitting this form, you agree to our 

Why we chose it, how we built on it, and where we’re going next

Ensuring the integrity of open source software is a growing priority for organizations of every size. But doing it in a way that doesn’t slow down developers is hard.

We believe the right long-term answer is a curated repository of known-good open source software that is continuously verified, with your organization’s security and compliance policies applied, and deeply integrated into your core workflows.

Cloudsmith is the right place to do this. We’re not just hosting packages; we’re providing the control plane and data plane for the software supply chain. And that starts with how we handle vulnerability data and threat intelligence.

We chose Trivy as the base for vulnerability scanning at Cloudsmith because it’s open source, fast, and widely trusted. 

We integrated Trivy into our cloud-native platform, giving our customers access to 

We’re expanding beyond Trivy, ingesting multiple data sources and ultimately adding pluggable security integrations.

 A curated, secure, resilient software supply chain that keeps developers productive and organizations safe.

 early on, as we were building Cloudsmith. It’s open source, well-supported, and widely trusted. It offers support for containers, OS packages, language dependencies, SBOMs and secrets scanning. It’s also well-maintained; with over 27,000 GitHub stars, millions of downloads, and millions of users, the global developer community clearly values the capability that Trivy provides.

It’s no surprise that Trivy is the default scanner in many other platforms. But integrating it into a cloud-native platform like Cloudsmith, where artifacts are constantly being pushed, pulled and promoted across repositories, meant solving for cloud scale, automation, and extensibility.

Trivy helped us get high-quality results fast. Here’s how we super-charged it for our customers.

Every artifact pushed to or cached through Cloudsmith is scanned automatically, without any manual configuration or setup required. This means security is built into the pipeline from the very first interaction. The scans run in the background, ensuring zero friction for developers while giving teams continuous visibility into security risks.

: Every Docker/OCI image published to Cloudsmith is automatically accompanied by an SBOM in the CycloneDX format. CycloneDX is widely supported across security tools and ecosystems, making it easy to integrate SBOMs into your broader supply chain risk management processes. By leveraging Trivy’s SBOM capabilities, we ensure that every image has a clear and standardized inventory

Because Cloudsmith is a universal artifact management platform, we can centralize vulnerability data for our customers across all of their formats and surface that information to them across their workspace. 

Cloudsmith is designed to work at global scale, so when we integrated Trivy as our scanner, we knew it needed to keep up too. Cloudsmith is 

proven to handle > 1 million requests per minute

 and we execute millions of vulnerability scans as customers add to their repositories.

Quarantine or notify when users are accessing insecure packages using Cloudsmith’s OPA based 

SAML, SCIM, OIDC, logging, and ISO 27001 compliance ensure a 

With Trivy running reliably across our platform, we started rethinking how to keep vulnerability data fresh and actionable.

We ingest CVE data continuously, from Trivy and also from additional sources like 

. And we apply that data to artifacts already in your repositories. That means no need to trigger rescans.

New advisory published? We re-check your existing packages against fresh data.

Define rules using CVSS, EPSS, license metadata or any other detail about your package, and act on them automatically.

 Every match, every decision, and every policy action is logged.

So we can add data sources like OSV.dev and package health signal data.

This turns scanning into a real-time feedback loop, so you can catch new risks as soon as they emerge.

The presence of CVEs isn’t the only signal about the quality of software packages. Our goal is to help you make better decisions about all the software in your supply chain based on trust, context, and quality, in addition to known vulnerabilities.

 New feeds (OSV, GitHub advisories, OpenSSF Scorecards) deepen our vulnerability data and unlock additional package formats.

 Build policies based on how well-maintained a package is, whether it has good documentation, how widely it’s been adopted, and other indicators of package health

 SBOM generation for additional formats, so you can build custom policies from your SBOM metadata.

Trivy kickstarted it. Cloudsmith takes it further.

Push an artifact. Let Cloudsmith scan it, sign it, apply policies, and let you know when new threats emerge. Security shouldn’t slow you down. With Cloudsmith, it doesn’t.

 Push an image or package and watch your policies kick in, so you can sleep easier tomorrow when the next CVE lands.

Ciara Carey

Solutions Engineer

Using Trivy Inside Cloudsmith

Cloudsmith built Enterprise Policy Management (EPM) on Open Policy Agent (OPA) and uses Rego to define policies as code. These policies control how packages move through your systems. They're versioned, reviewable, and enforceable.

EPM is in early release, but it already draws on extensive metadata Cloudsmith collects from your artifacts: format, version, tags, license, vulnerability, malware scan results, and digital signatures. Policies tap into this data to take action based on what matters to your team.

Enterprise Policy Management with Cloudsmith

This article follows the example provided by Ciara Carey, a Solutions Engineer at Cloudsmith, shown in the video below.

EPM edited

From the Cloudsmith interface, navigate to the 

 policy to view the Rego-based rules for an example policy. These code-defined policies give you fine-grained control over artifact behavior.

This policy evaluates multiple risk indicators across all known vulnerabilities for a package to determine whether it should be flagged and quarantined. These indicators include CVSS and EPSS scores, the presence of a patch, and the age of the vulnerability.

At the top of the code, we set up our Rego script with the necessary dependencies:

 variable to store whether the vulnerability matches our criteria:

We’re testing against parameters including EPSS and CVSS scores, repo name, age, and CVE exclusion, and these are declared as variables:

 from the lower setting in the video, to reflect a more realistic threshold.

 block, which evaluates the conditions for each vulnerability and sets match to true if all pass:

This example uses a nuanced policy that checks for several risk factors before it triggers an action. Let’s examine these checks and the code they use.

Target Repository and Iterate Vulnerabilities

Make sure we are targeting our preferred repo:

Then loop through each reported vulnerability. The policy then applies the conditions to every vulnerability in the dataset. A vulnerability is bound to the 

Apply and Evaluate Conditions for Each Vulnerability

The following checks are then applied to each vulnerability for the package:

 – Skips known and accepted vulnerabilities to reduce unnecessary noise:

This uses a simple Rego helper rule to check if the vulnerability is in the ignore CVE list:

– This check ensures that a patched version of the package exists. If not, the policy will not trigger:

 – Evaluates the severity of any vulnerability using a configured CVSS threshold:

This uses a helper rule to check if the EPSS score exceeds our limit:

 – Evaluates the likelihood of vulnerability exploitation using the configured EPSS threshold:

– This checks the vulnerability's age by comparing its published date to a threshold of 30 days ago. This gives the vulnerability a grace period to establish itself. If the vulnerability was published before that date, it meets the age condition for further evaluation:

 panel, you can add a series of actions taken in response to a policy trigger. In this example, Cloudsmith performs the following automated actions:

 – Adds a visible marker so teams can immediately identify problematic artifacts.

 – Blocks the artifact from being downloaded, deployed to infrastructure, or promoted to other repositories.

Once the actions have been added, toggle the switch to the right of the policy name to ensure the policy is active.

To test the policy, upload a package that matches the policy conditions. For example, one with a known vulnerability that exceeds the configured CVSS and EPSS thresholds.

 to push a package that triggers the policy.

Cloudsmith automatically scans the package, extracts metadata, and applies the policy. In the example, if the conditions match, Cloudsmith:

Quarantines it to block deployment, download, and promotion

The API offers a range of instructions to manage policies using EPM. For example, use the simulate API to test policies without enforcing them. This returns results as if the policy were active, helping teams validate changes safely.

Open the decision log to examine how the policy responded. Locate the policy ID and view the result. The interface shows the evaluated Rego policy and the triggered event's full context.

You'll find detailed metadata from the package, including:

This information forms the basis for policy evaluation. Scroll to the bottom to see what actions the policy took. The decision log provides a transparent record of what happened and why.

Ian Taylor

Tech Content Director

Enterprise Policy Management Example: Quarantine Packages Using Policy as Code

Cloudsmith’s Enterprise Policy Management (

) now supports the Exploit Prediction Scoring System (

), a data-driven metric designed to estimate the probability of a software vulnerability being exploited in the wild. Using EPM in Cloudsmith, you can now use a package’s EPSS score to inform your package workflows, including those around 

EPSS scores or estimates the likelihood (probability) that a software vulnerability will be exploited in the wild. Cloudsmith users can use EPSS scores to prioritize vulnerabilities most likely to be exploited, to strengthen your organization’s security posture and automate your response to vulnerabilities.

) and leverage EPSS-based logic in their OPA policies for more granular, data-informed decisions around vulnerability management. This automated responses approach allows Cloudsmith users to remain protected in real time as Cloudsmith automatically re-checks and re-applies your policies when EPSS scores change.

 will quarantine and tag a software package with “

” vendor severity rating and if the EPSS score exceeds the defined threshold in your 

For the purpose of a real-world demonstration, we will use the vulnerable Spotipy package as highlighted in 

 example is a Python library specifically used with the Spotify Web API. Affected versions of this package are vulnerable to 

 through the CacheHandler class. In this scenario an attacker could gain unauthorized access to admin-level actions on the Spotify account by reading Spotify authentication tokens exposed in the file created by the CacheHandler class with the 

What’s interesting about this example is that it was picked up by EPSS but hasn’t yet received a “vendor severity” scoring from 

, emphasizing the need for EPSS as well as traditional vendor scoring sources within our EPM policies. Vulnerability naming schemes, like the Common Vulnerabilities and Exposures (

) system, provide standardised identifiers for publicly known IT system vulnerabilities. This CVE classification differs from EPSS in the sense that EPSS uses real-world threat data to predict the likelihood of those vulnerabilities being exploited

In the above example, you can see that spotify was detected with a vulnerability from the recently applied policy. The tag was added with “exceeded-epss” providing that it was the EPSS predictability score that caused the quarantine status. Package quarantining allows users to temporarily block any downloads of a package until you release the package from that quarantine state.

If you like to see a demo of the Cloudsmith’s EPM capabilities with EPSS confidence scoring, why not call over to 

, South Hall – ExCeL London. We’ll be providing live demos until Friday.

Nigel Douglas

Head of Developer Relations

Cloudsmith introduces EPSS Scoring in Enterprise Policy Management (EPM)

In a rapidly evolving digital environment, organizations across various sectors—including technology firms, financial services, and manufacturing—rely on effective management of software artifacts to secure their software supply chains

The risk of supply chain attacks has intensified, revealing vulnerabilities at every stage of artifact management. Compliance breaches, data leaks, and unvetted code present serious threats, and Cloudsmith aimed to tackle these challenges head-on.

Cloudsmith, renowned for its cloud-native artifact management platform, has introduced the 

—a powerful and flexible policy engine tailored to modern security needs. With the integration of Open Policy Agent (OPA) and Cloudsmith’s search capabilities, the Enterprise Policy Manager allows organizations to define, enforce, and monitor policies across their artifact lifecycle.

The software supply chain faces several pressing security and compliance issues:

: Vulnerabilities in third-party components open doors for attackers, making controlled artifact ingestion vital.

: Increasing regulations demand strict adherence to compliance standards.

: Without enforceable policies, unmanaged access and configurations can increase the risk of incidents.

: Many tools lack flexibility, offering predefined policies that may not address unique security needs.

Cloudsmith’s Solution: Enterprise Policy Manager

Cloudsmith’s Enterprise Policy Manager is a comprehensive solution that serves as a control plane across the entire artifact management lifecycle. Leveraging OPA, the platform enables organizations to implement custom, consistent, and traceable policies, strengthening their security posture.

“Software supply chain attacks are a growing concern,” said Glenn Weinstein, CEO of Cloudsmith. “Our Enterprise Policy Manager provides complete control over software artifact ingestion, access, and delivery, protecting organizations from vulnerabilities, bad actors, and misconfigurations.”

Key Benefits of Enterprise Policy Manager

Cloudsmith’s Enterprise Policy Manager directly addresses these challenges with features that enhance security and simplify policy management:

: Build policies based on any available data or attribute, ensuring they align with specific security and compliance standards.

: Speed up implementation with templates for common use cases, reducing time to achieve a secure software supply chain.

: Safeguard against untrustworthy packages by enriching package data. Cloudsmith integrates multiple data sources for thorough quality and risk analysis.

: Use Cloudsmith’s API to automate policy creation and store policies as code, enabling consistent, observable, and repeatable security practices.

With Enterprise Policy Manager, Cloudsmith empowers organizations to:

: Hosting policies on the artifact management platform offers enterprise-wide policy enforcement, reducing misconfiguration risks.

: OPA-based policies provide a consistent, scalable security posture.

: With clear, automated policies, organizations can confidently maintain compliance and reduce audit burdens.

In a world where supply chain security is paramount, Cloudsmith’s Enterprise Policy Manager provides the flexibility, insights, and automation needed to build a resilient and secure software ecosystem.

Stay ahead of evolving security threats and safeguard your software supply chain with Cloudsmith’s Enterprise Policy Manager. Experience how our flexible policy engine, combined with powerful integrations, helps you enforce security policies, enhance compliance, and protect your organization from vulnerabilities. Schedule a personalized demo to explore how Cloudsmith’s Enterprise Policy Manager can streamline policy management and ensure a more resilient, secure software ecosystem for your team.

 and see how Cloudsmith can help you take control of your software artifacts and mitigate risks across your supply chain.

Cloudsmith Blog

Using Trivy Inside Cloudsmith

Enterprise Policy Management Example: Quarantine Packages Using Policy as Code

Cloudsmith introduces EPSS Scoring in Enterprise Policy Management (EPM)

Introducing Cloudsmith’s Enterprise Policy Manager