Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Chainguard Bags Massive $50M Series A for Supply Chain Security

Venture capital powerhouse Sequoia is leading a massive $50 million early-stage investment in Chainguard, a startup created by a team of ex-Google software engineers to “make software supply chain secure by default.”

Venture capital powerhouse Sequoia is leading a massive $50 million early-stage investment in Chainguard, a startup created by a team of ex-Google software engineers to “make software supply chain secure by default.”

The Series A funding comes less than six months after Chainguard emerged from stealth with $5 million in seed capital and signals massive investor interest in technology to address weaknesses in the software supply chain.

In addition to Sequoia Capital, Chainguard’s massive Series A attracted the attention to Amplify, Chainsmokers’ Mantis VC, LiveOak Ventures, Banana Capital, K5/JPMC and several prominent angels.

Chainguard also rolled out its first product, called Chainguard Images, to provide organizations with a secure set of base images that are fully signed with Sigstore and continuously updated with Service Level Agreements (SLAs), Software Bill of Materials (SBOMs) and Certifications (FIPS, SLSA).

“Chainguard Images are the first container base images designed for a secure software supply chain. Chainguard Images are continuously updated base container images that aim for zero-known vulnerabilities,” co-founder and CEO Dan Lorenc said in a note announcing the company’s first product.

[ READ: Ex-Googlers Snag $5 Million for Software Supply Chain Security ]

Sequoia Capital partner Bogomil Balkansky said the pedigree of the founders as engineers in the open-source supply chain ecosystem was key to its investment. 

Chainguard was created by Dan Lorenc and Kim Lewandowski and the team that worked on Google’s major supply chain security initiatives — Sigstore and SLSA. 

“High profile software supply chain attacks like Log4j have flashed a spotlight on the need to establish a foundation of trust in the software that companies put in production. Chainguard gives companies confidence in the critical open source software they deploy by providing a low-friction, developer-friendly way of signing and verifying software artifacts so they have a trail to trace if a breach does occur. The Chainguard team are thought leaders in this space, and it is the right team at the right time in history to tackle this problem,” Balkansky said.

Chainguard and its investors are betting on a major market for its tools and services as increased attention is paid to hidden weaknesses in the software ecosystem. The company says it is innovating to create a software supply chain where every artifact can be verifiably traced back to the source code and hardware it was built on and by whom.

“[We are] making sense of the chaotic security solutions space by seamlessly integrating security into the software development lifecycle. It’s a holistic, end-to-end solution from development to production to policy management,” Chainguard said.

Related: Ex-Googlers Snag $5 Million for Software Supply Chain Security

Related: Google Intros SLSA Framework to Enforce Supply Chain Integrity

Related: Codecov Dev Tool Compromised in Supply Chain Attack

Related: Everything You Need to Know About the SolarWinds Mega-Hack

Related: On-Demand: Supply Chain Security Summit 2022

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.