From "CVE Theater" to Verifiable Integrity: Architecting the Post-Patching Supply Chain - Chainguard

‍

Overview

In this CISO Inspired Summit masterclass, Denis Maligin, Sales Engineering Manager at Chainguard, argues that the "patching treadmill" has become a strategic trap for CISOs. Organisations pour money into vulnerability management to lower CVE counts, yet the most sophisticated 2026 breaches succeeded without exploiting a single unpatched vulnerability. They worked because supply chains lack verifiable integrity.

Denis walks through recent supply chain attacks, including the Trivy infrastructure hijack, the Axios maintainer takeover and the self-replicating Shai-Hulud worm, and shows how attackers bypassed "green" dashboards by poisoning trusted sources. He then explains what regulation such as the EU Cyber Resilience Act means for software producers, and why SBOMs generated after the build can miss what is really inside an application, using Keycloak as an example.

Key takeaways

  • Modern supply chain attacks target trusted sources and build pipelines rather than unpatched CVEs, so low CVE counts alone are not evidence of security.
  • The Shai-Hulud campaign exposed almost 300,000 secrets on GitHub, around 33,000 of them unique.
  • The Cyber Resilience Act raises the bar on secure-by-default software and accurate SBOMs.
  • Traditional SDLC maintenance creates a "wheel of friction" across teams that restarts with every release.
  • Minimal, distroless images built from source (Chainguard's Wolfi-based approach) can cut exposure dramatically; Denis cites a critical Ingress Nginx vulnerability fixed in under 24 hours, before the official patch was available.

Explore more masterclasses

View all
AI: Where Ambition Meets Reality - CAIO Inspired Summit Closing Panel
Artificial Intelligence
2
November
2026
AI: Where Ambition Meets Reality - CAIO Inspired Summit Closing Panel
Leaders from NatWest Group, HSBC and Reckitt discuss where AI is delivering real value, who should own it, why humans must stay in the loop and how organisations need to redesign work around it.
Rediscovering Proposition Innovation - E.ON
Marketing
2
November
2026
Rediscovering Proposition Innovation - E.ON
Andy Sage of E.ON explains how behavioural drivers, Maslow’s hierarchy of needs and the adoption curve can help marketers rethink product design, pricing, channels and partnerships.
Designing Embedded Systems with AI inside - Thales UK
Artificial Intelligence
2
November
2026
Designing Embedded Systems with AI inside - Thales UK
Anthony Collins of Thales UK explains how to design, explain and trust AI inside mission-critical embedded systems, from defining outcomes and managing data to guard rails, human oversight and red teaming.