Cloudsmith has raised $123m to date, a record for a Northern Ireland start-up. Its co-founder Alan Carson talks about scaling a global B2B software company from the region, and why others can do it too.
Hosts Christina Richmond and Rory Duncan are joined this week by Glenn Weinstein, CEO of Cloudsmith to discuss building high-performing company cultures, navigating software supply chain risks, and securing modern development workflows. To counter machine-speed AI threats, Glenn proposes that organizations must embed automated “don’t make me think” security guardrails directly into workflows so developers don’t expend cognitive energy on manual vulnerability checks. Much like sports team management taking care of logistics so athletes can focus on competing, leadership should automate background security tasks to free developers to concentrate on solving core customer problems.
Tensorlake SDK hit by a Mini Shai-Hulud copycat, fake interview repo plants a rogue .npmrc, and 42 malicious crypto gems on RubyGems
Josh chats with James Matchett from Cloudsmith about a new report they put out. It has some scary looking statistics in it about how organizations are using dependencies. There are some surprising numbers in there, but the story is really one of defense in depth. There’s no single thing we can do here, it’s all about knowing what you have every step of the way. It’s easy to say, but certainly a challenge to do right. James is a ton of fun to chat with and filled with energy and knowledge
Cloudsmith has published research highlighting a gap between engineering teams’ confidence in their software supply chain defences and the steps they take to screen dependencies. The study surveyed 400 Platform and Security Engineers in the UK and US.
A survey of 400 platform and security engineers in the U.S and United Kingdom (UK), finds nearly three quarters (73%) are either only moderately confident (58%) or not confident (15%) in the ability of their existing tools for managing software artifacts to prevent attacks against their organization’s software supply chain. Conducted by Cloudsmith, a provider of a platform for managing software artifacts, the survey also finds nearly half of respondents (48%) can identify an intrusion in their software supply chain but need to rely on manual efforts to enforce some type of quarantine or resolve the issue. Only 37% said they can automatically identify, block, and trace an intrusion within minutes.
Cloudsmith’s 2026 Artifact Management Report revealed that only one in four engineering automaticallly generate and verify their software bill of materials (SBOM) for every build; the other 75 percent do it manually and reactively. Further, those three in four reported they have difficulty generating a detailed report of artifacts, version, origins and security attestations for any kind of surprise audit.
Cloudsmith, the leading cloud-native artifact management and software supply chain platform, today announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies and expanded evaluation triggers.
Cloudsmith appointed Mark O'Connor as Chief Financial Officer and Dan Lascell as General Counsel, strengthening its executive leadership team as the company scales to meet the demands of Fortune 500 and Global 2000 customers. The hires follow Cloudsmith's $72M Series C and position the company to meet IPO-scale financial, legal, and governance standards.