--- title: "Software supply chain security for Cboe Global Markets" description: "See how Cloudsmith helps globally distributed engineering teams at financial market infrastructure providers control open-source dependencies, enforce centralized security policy, and meet regulatory requirements across the SEC, CFTC, FCA, and MiFID II." canonical_url: "https://cloudsmith.com/loves/cboe" last_updated: "2026-05-20T12:36:20Z" --- # Software supply chain security for Cboe Global Markets Cloudsmith x Cboe Global Markets ## Your trading platform is secured. What about the upstream? As attackers turn their focus on the financial sector, Cloudsmith governs what enters your software supply chain – so every dependency meets your security and compliance standards. [See how Cloudsmith works](https://cloudsmith.com/product/software-supply-chain-security) ## The Cloudsmith difference Your security investment is real. But every tool in your stack operates after a dependency has already entered your environment. Cloudsmith governs what enters – so the rest of your controls work on a cleaner, verified foundation. | Your current solution | With Cloudsmith | | --- | --- | | Dependencies enter your environment before your scanning tools see them. | Cloudsmith scans and blocks at the entry point – before a package touches your pipelines or reaches your trading systems. | | Security policy varies across teams, asset classes, and geographies. | One policy, defined centrally, applies across every team, format, and pipeline – from equities to derivatives to FX. | | No automated SBOM generation to satisfy regulatory audit requirements. | Cloudsmith generates SBOMs and maintains the audit trails your compliance obligations require – built in, not bolted on. | | AI-recommended dependencies enter your supply chain unverified. | Every AI-recommended package passes through the same governance controls as any other artifact entering your supply chain. | ## Don't just identify threats. Block them. Most scanning tools catch problems after a dependency has already entered your environment. Cloudsmith sits upstream – governing what enters at the point of consumption, not after the fact. Attackers know this gap exists. Recent campaigns targeting npm and PyPI have shown how malicious packages slip through precisely because they're consumed before security tools see them. - Block malicious packages at the point of consumption – not after the fact - Protect against npm and PyPI supply chain attacks before they reach your engineers - Enforce policy centrally across every team, format, and region - Apply the same controls to AI-recommended dependencies as any other artifact [Learn more about software supply chain security](/product/software-supply-chain-security) Further reading ## The threat is not theoretical Recent supply chain attacks show exactly how attackers exploit the gap between dependency consumption and security scanning. [Stardrop: New cross-industry npm campaign targeting AI companies and financial firms](/blog/stardrop-npm-campaign) [Axios npm packages compromised: what happened and how to respond](/blog/axios-npm-attack-response) [Closing the enforcement gap: why visibility isn't enough for supply chain security](/blog/closing-the-enforcement-gap-why-visibility-isn-t-enough-for-supply-chain-security) [Slopsquatting and typosquatting: how AI-hallucinated packages become attack vectors](/blog/slopsquatting-and-typosquatting-how-to-detect-ai-hallucinated-malicious-packages) [The AI speed trap: securing the future of software supply chains](/blog/the-ai-speed-trap-securing-the-future-of-software-supply-chains) Why financial services firms choose Cloudsmith ## Built for the complexity of financial services Financial services engineering teams face pressures that generic DevOps tooling wasn't designed for: regulatory scrutiny of your SDLC, targeted attacks on your supply chain, and the constant churn of M&A activity fragmenting your tooling and processes. Cloudsmith is built to handle all three. ### Higher risk Crypto and fintech firms are actively targeted by malicious packages designed to exploit their specific dependencies. Cloudsmith blocks threats at the point of consumption, before they reach your pipelines. ### Compliance-ready Firms gaining banking licenses or operating under DORA, FCA, or SEC oversight need supply chain controls baked into their SDLC. SBOM generation, audit trails, and policy enforcement built in, not retrofitted after a regulatory review. ### M&A-proof M&A activity leaves engineering organizations with fractured tooling, inconsistent processes, and repositories that don't talk to each other. Cloudsmith gives you a single platform to consolidate onto, without disrupting the pipelines that depend on them. ## AI is accelerating your development. It's also accelerating your attack surface. Whether it's GitHub Copilot suggesting a dependency, an AI agent pulling a package autonomously, or a developer using an LLM to scaffold a new service – AI-assisted development is already happening across Cboe's engineering teams. That's not a problem. But every AI-recommended package that enters your supply chain unchecked is an unverified artifact. Cloudsmith makes sure the speed of AI development doesn't come at the cost of supply chain integrity. ### Upstream dependency scanning Cloudsmith scans every package – including AI-recommended dependencies – for malware and CVEs before it reaches your engineers. ### Policy-based blocking Packages that don't meet your standards get blocked before a build runs – regardless of how they were sourced or recommended. ### Consistent governance The same rules apply to AI-generated dependencies as any other artifact entering your supply chain – no exceptions for speed or convenience. ### AI tooling visibility See what your AI development tools pull into your environment, where it came from, and whether it meets your security policy – before it touches production. ## Six capabilities. One platform. Cloudsmith gives your central engineering and InfoSec teams control over what enters your supply chain, how it's governed, what's in it, and how it gets to your teams. ### Centralize policy enforcement across distributed teams Cboe operates across multiple asset classes, geographies, and business units. Cloudsmith's Enterprise Policy Manager lets your central team define vulnerability policies, license restrictions, and compliance rules once. They apply across every team, every format, and every pipeline – automatically. ### A dependency firewall for your supply chain Cloudsmith proxies all upstream open-source consumption through a governed layer. Every package is scanned for malware and CVEs before it reaches your developers. Anything that doesn't meet your standards is quarantined or blocked at the point of ingestion – not flagged after the fact. ### Supply chain visibility and SBOM generation Cloudsmith gives you a complete view of every artifact in your supply chain: what it is, where it came from, and whether it meets your current policy. Artifact signing, dependency tracing, and automated SBOM generation give your compliance teams the evidence chain they need – without a separate compliance exercise. ### Global distribution without the overhead Engineering teams in North America, Europe, and Asia Pacific get fast, reliable access to the artifacts they need – without your platform team managing the infrastructure that delivers it. Cloudsmith replicates across regions automatically, with built-in high availability and BCDR at no additional cost. ### Multi-format artifact management npm, Helm, Maven, Python, NuGet, Docker – all governed from a single platform. One set of policies. One source of truth. No fragmented repository estate to maintain across your engineering organization. ### Consolidate a fragmented artifact estate Growth through acquisition leaves engineering organizations with fragmented tooling, inconsistent processes, and repositories that don't talk to each other. Cloudsmith gives you a single platform to consolidate onto – unifying policy enforcement and bringing every team onto the same governed foundation without disrupting the pipelines that depend on them. ## Built for audit. Not bolted on. Financial market infrastructure operators face a growing body of regulation that extends beyond traditional IT controls – into software supply chain integrity, third-party dependency risk, and operational resilience. Cloudsmith gives your compliance and governance teams what they need: SBOM generation, policy enforcement with audit trails, and full package provenance tracking – built into your pipelines, not retrofitted after the fact. ## Customers love Cloudsmith [Read reviews](https://www.g2.com/products/cloudsmith/reviews) Talk to our team about securing Cboe's software supply chain – from dependency governance to compliance-ready audit trails. [Get in touch](/contact)