Venture capital powerhouse Sequoia is leading a massive $50 million early-stage investment in Chainguard, a startup created by a team of ex-Google software engineers to “make software supply chain secure by default.”
The Series A funding comes less than six months after Chainguard emerged from stealth with $5 million in seed capital and signals massive investor interest in technology to address weaknesses in the software supply chain.
In addition to Sequoia Capital, Chainguard’s massive Series A attracted the attention to Amplify, Chainsmokers’ Mantis VC, LiveOak Ventures, Banana Capital, K5/JPMC and several prominent angels.
Chainguard also rolled out its first product, called Chainguard Images, to provide organizations with a secure set of base images that are fully signed with Sigstore and continuously updated with Service Level Agreements (SLAs), Software Bill of Materials (SBOMs) and Certifications (FIPS, SLSA).
“Chainguard Images are the first container base images designed for a secure software supply chain. Chainguard Images are continuously updated base container images that aim for zero-known vulnerabilities,” co-founder and CEO Dan Lorenc said in a note announcing the company’s first product.
[ READ: Ex-Googlers Snag $5 Million for Software Supply Chain Security ]
Sequoia Capital partner Bogomil Balkansky said the pedigree of the founders as engineers in the open-source supply chain ecosystem was key to its investment.
Chainguard was created by Dan Lorenc and Kim Lewandowski and the team that worked on Google’s major supply chain security initiatives — Sigstore and SLSA.
“High profile software supply chain attacks like Log4j have flashed a spotlight on the need to establish a foundation of trust in the software that companies put in production. Chainguard gives companies confidence in the critical open source software they deploy by providing a low-friction, developer-friendly way of signing and verifying software artifacts so they have a trail to trace if a breach does occur. The Chainguard team are thought leaders in this space, and it is the right team at the right time in history to tackle this problem,” Balkansky said.
Chainguard and its investors are betting on a major market for its tools and services as increased attention is paid to hidden weaknesses in the software ecosystem. The company says it is innovating to create a software supply chain where every artifact can be verifiably traced back to the source code and hardware it was built on and by whom.
“[We are] making sense of the chaotic security solutions space by seamlessly integrating security into the software development lifecycle. It’s a holistic, end-to-end solution from development to production to policy management,” Chainguard said.
Related: Ex-Googlers Snag $5 Million for Software Supply Chain Security
Related: Google Intros SLSA Framework to Enforce Supply Chain Integrity
Related: Codecov Dev Tool Compromised in Supply Chain Attack
Related: Everything You Need to Know About the SolarWinds Mega-Hack
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- VMware Confirms Exploit Code Released for Critical vRealize Logging Vulnerabilities
- Gem Security Gets $11 Million Seed Investment for Cloud Incident Response Platform
- Ransomware Leads to Nantucket Public Schools Shutdown
- Sentra Raises $30 Million for DSPM Technology
- Saviynt Raises $205M; Founder Rejoins as CEO
- OpenVEX Spec Adds Clarity to Supply Chain Vulnerability Warnings
- Tenable Launches $25 Million Early-Stage Venture Fund
- VMware Plugs Critical Code Execution Flaws
Latest News
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
