Secure by Design, Strong by Default: Building Resilient Software Supply Chains - Chainguard
Overview
In this CISO Inspired Summit masterclass, Iheanyi Njeze, Enterprise Sales Engineer at Chainguard, argues that the software supply chain is now the primary attack surface, and that visibility tools such as SBOMs and vulnerability scanners cannot, on their own, stop the attacks being executed today.
Drawing on real-world incidents, including the March 2026 compromise of the aquasecurity/trivy-action repository, where secrets were silently exfiltrated while security scans still "passed", the session shows how adversaries have shifted their focus to the build and distribution layer. Iheanyi also looks at the compounding engineering cost of CVE remediation across the SDLC, and makes the case for a "secure-by-default" sourcing strategy that removes whole categories of risk rather than managing them one CVE at a time.
Key takeaways
- Almost 98% of malware is inserted at the point of build or distribution, so scanning downstream is, by design, too late.
- Only around 20% of organisations agree they understand everything inside their workloads; visibility does not equal integrity.
- CVE remediation diverts engineering time away from revenue-generating work and is increasingly hard to justify to the business.
- Chainguard rebuilds its artifacts daily, covers more than 2,400 popular container projects, and commits to fix SLAs of 7 days for critical CVEs, 14 days for others and 24 hours for CVEs with a known exploit.
- A trusted, secure-by-default source is particularly relevant for organisations navigating CRA, NIS2, DORA, PCI DSS, FedRAMP, UK Cyber Essentials or HIPAA compliance.
